CVE-2020-11986

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.

• https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406%40%3Cnotifications.netbeans.apache.org%3E
• https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984%40%3Cnotifications.netbeans.apache.org%3E
• https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/r0fb2ba21a0469f64c2dff945dbe68f7b1122e1bff2b2b46271682406%40%3Cnotifications.netbeans.apache.org%3E
• https://lists.apache.org/thread.html/ra81cdcf325bf4ea085c178f95ed6b50d4f1c095be50577b2f9b88984%40%3Cnotifications.netbeans.apache.org%3E
• https://lists.apache.org/thread.html/rbb8ea1b684e73107a0a6a30245ad6112bec2e6e171368c808e69217e%40%3Cannounce.netbeans.apache.org%3EMailing List, Vendor Advisory

Published

Sep 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11980In Karaf, JMX authentication takes place using JAAS and auth…6.3
• CVE-2020-11981An issue was found in Apache Airflow versions 1.10.10 and be…9.8
• CVE-2020-11982An issue was found in Apache Airflow versions 1.10.10 and be…9.8
• CVE-2020-11983An issue was found in Apache Airflow versions 1.10.10 and be…5.4
• CVE-2020-11984Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info dis…9.8
• CVE-2020-11985IP address spoofing when proxying using mod_remoteip and mod…5.3
• CVE-2020-11987Apache Batik 1.13 is vulnerable to server-side request forge…8.2
• CVE-2020-11988Apache XmlGraphics Commons 2.4 and earlier is vulnerable to …8.2
• CVE-2020-11989Apache Shiro before 1.5.3, when using Apache Shiro with Spri…9.8
• CVE-2020-1199An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-11990We have resolved a security issue in the camera plugin that …3.3
• CVE-2020-11991When using the StreamGenerator, the code parse a user-provid…7.5