Gradle vulnerable to local privilege escalation through system temporary directory

Path traversal vulnerabilities in handling of Tar archives in Gradle

In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects

Local privilege escalation through system temporary directory

Dependency verification bypass in Gradle

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources

In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password

Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP…

Arbitrary code execution via specially crafted environment variables

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them

Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts

Gradle fails to disable repositories which can expose builds to malicious artifacts

Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution

In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning