owasp dependency-track vulnerabilities

Latest owasp dependency-track CVEs

Newest publication first

1. CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

   Published 2022-10-25

   Medium·CVSS 4.4 EPSS 0.22%

   Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependen...

2. CVE-2019-1020007 Dependency-Track before 3.5.1 allows XSS.

   Published 2019-07-29

   Medium·CVSS 5.4 EPSS 0.65%

   Dependency-Track before 3.5.1 allows XSS.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.