Skip to main content

Vendors Questionnaires Investors News

0-Doubt — neutral IT/Security research

Browse Products Market reports Resellers Certified analysts Investors RFI/RFP questionnaires How trust works Nothing here is ranked by payment Help & FAQ API Privacy Terms Cookies

SonarSource SonarQube | 0-Doubt

Home
Vendors
Sonar
SonarSource SonarQube

Home
Vendors
Application Security (ASPM)
SonarSource SonarQube

SonarSource SonarQube

AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →Secure coding rating: 0/100How this score is computedA product with no known CVEs starts at a neutral score and climbs the longer it goes without one; a product with known CVEs is penalized by severity instead. This one has 9 known CVEs (vendor-level match — see the CVE list below) and is tracked as ~107 days old in our catalog (a stand-in for real release date, which we don't track). The platform admin controls the formula's weights.

Code quality and security platform with SAST, SCA, and AI-powered remediation

by Sonar · sonarsource.com · source ↗

Screenshots

1

SonarSource SonarQube — screenshot

Known CVEs (9)

CVE-2024-47161 ↗MEDIUM 4.32024
In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
CVE-2023-24442 ↗MEDIUM 5.52023
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the …
CVE-2022-46688 ↗MEDIUM 6.5

Materials

0

No datasheets, whitepapers, case studies, videos, or demos linked yet.

Other Application Security (ASPM) products

Snyk IaC · Snyk
Snyk Open Source · Snyk
Snyk Open Source License Compliance · Snyk
Software Improvement Group Sigrid® · Software Improvement Group
SonarSource SonarQube Cloud · Sonar
Sonatype Lifecycle · Sonatype
Sonatype SBOM Manager · Sonatype
Sprocket Security · Sprocket Security

2022

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenk…

…and 6 more · see all on the vendor page →