Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Repositories of datanucleus are fetched over insecure protocol (http insted of https)#879740 | Valid | Cryptography | High | 2020-10-05 | – | 1 |
| c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration#509315 | Valid | Other weaknesses | Medium | 2019-04-16 | – | 5 |
| Unsafe deserialization in Nexus Repository helm plugin#917843 | Valid | Deserialization and Object Injection | Critical | 2020-09-10 | – | 5 |
| OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix#724599 | Valid | Command and Code Injection | Critical | 2020-06-29 | – | 7 |
| Unrestricted File Upload Leading to Remote Code Execution#683965 | Valid | Input Validation and Logic | Critical | 2019-10-30 | – | 12 |
| OS Command Injection in Nexus Repository Manager 2.x#654888 | Valid | Command and Code Injection | Critical | 2019-08-20 | – | 28 |
| OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)#688270 | Valid | Command and Code Injection | Critical | 2019-10-29 | – | 34 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.