Beni Saprulah

**Name of the Vulnerable Software and Affected Versions** Nexus Repository 3 versions 3.2.0 through 3.95.x **Description** A sensitive information disclosure issue exists in the capability read API. An account with the `nexus:capabilities:read` privilege can retrieve the plaintext shared secret configured on a webhook capability, which should be masked in all API responses. **Recommendations** Update to version 3.96.0.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A user with permissions to update privilege definitions can modify a wildcard privilege assigned to their own role. This allows them to grant themselves broader permissions than authorized, potentially leading to full administrative access, as the system fails to perform additional authorization checks or require role reassignment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.