4991 matches found
Jira plugin STAGIL Navigation 路径遍历漏洞
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace. A security vulnerability exists in Jira plugin STAGIL Navigation prior to version 2.0.52, which stems from the presence o...
Information disclosure via Synchrony service
Affected versions of Atlassian Confluence Server allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the Synchrony service. This vulnerability was discovered by Rojan Rijal of Tinder Security Engineering. The affected versions are before version...
Information disclosure of names of attachments and labels in a private Confluence space - CVE-2023-22503
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...
Atlassian Jira < 9.0.0 Information Disclosure (JRASERVER-73926)
The version of Atlassian Jira Server running on the remote host is affected by an information disclosure vulnerability as referenced in the JRASERVER-73926 advisory, which can be exploited by an unauthenticated attacker. Note that Nessus has not tested for this issue but has instead relied only o...
New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices
A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different...
PT-2023-6683
Name of the Vulnerable Software and Affected Versions Atlassian Confluence Data Center and Server versions prior to 7.19.16, 8.3.4, 8.4.4, 8.5.3, and 8.6.1 Description Atlassian Confluence Data Center and Server are affected by an improper authorization vulnerability that allows an unauthenticate...
Fixed vulnerabilities in several Atlassian products
Atlassian has fixed vulnerabilities in several products that use git. The vulnerability is located in the included git implementation and allows a malicious person to to execute arbitrary code. For these vulnerabilities in git, security advisory NCSC-2023-0024 released. Atlassian has released...
Atlassian Bitbucket Public Repo Enumeration
Binary data bitbucketpublicrepoenumeration.nbin...
Atlassian Bitbucket RCE (CVE-2022-36804)
Binary data bitbucketcve-2022-36804.nbin...
CVE-2023-22501: Critical Broken Authentication Flaw in Jira Service Management Products
Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. On February 1, 2023, Atlassian published an advisory for CVE-2023-22501, a critical broken authentication vulnerability affecting its Jira Service Management Server and Data Center...
Atlassian's Jira Service Management Found Vulnerable to Critical Vulnerability
Atlassian has released fixes to resolve a critical security flaw in Jira Service Management Server and Data Center that could be abused by an attacker to pass off as another user and gain unauthorized access to susceptible instances. The vulnerability is tracked as CVE-2023-22501 CVSS score: 9.4...
Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework
Jira is not impacted no action is required as the vulnerability +cannot be exploited+. All Jira versions below 9.6 uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira +does not use the affected methods from the Spring+, hence +is not impacted+:...
Information Disclosure via QueryCompenentRenderer API
Affected versions of Atlassian Jira Server and Data Centre allowed an unauthenticated remote attacker to fetch Issue,Project and Sprint information via Information Disclosure Vulnerability via "/secure/QueryComponentRendererValue!Default.jspa" endpoint. Affected versions: version 9.5.1 Fixed...
Atlassian JIRA Service Desk 5.3.x < 5.3.3 / 5.4.x < 5.4.2 / 5.5.x < 5.5.1 Impersonation (JSDSERVER-12312)
The instance of Atlassian Service Desk hosted on the remote web server is 5.3 prior to 5.3.3, 5.4 prior to 5.4.2 or 5.5 prior to 5.5.1. Is is, therefore, affected by an authentication vulnerability. A remote attacker included on Jira issues or requests with other users can impersonate those users...
Exploit for Argument Injection in Atlassian Bitbucket
Atlassian-Bitbucket-Server-CVE-2022-36804 A critical command...
Exploit for Argument Injection in Atlassian Bitbucket
CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server A c...
Atlassian Bitbucket < 7.6.19 / 7.17.12 / 7.21.6 / 8.0.5 / 8.1.5 / 8.2.4 / 8.3.3 / 8.4.2 Command Injection
The version of Atlassian Bitbucket installed on the remote host 7.0.0 prior to 7.6.19, 7.7.0 prior to 7.17.12, 7.18.0 prior to 7.21.6, 8.0 prior to 8.0.5, 8.1 prior to 8.1.5, 8.2 prior to 8.2.4, 8.3 prior to 8.3.3 or 8.4 prior to 8.4.2. It is, therefore, affected by a command injection...
Recog Release v3.0.3
Recog Release v3.0.3, which is available now, includes updated fingerprints for Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus; Atlassian Bitbucket Server; and Supervisord Supervisor. It also includes new fingerprints and a number of bug fixes, all of which are detailed...
Atlassian Confluence Command Injection (CONFSERVER-79016)
According to its self-reported version number, the Atlassian Confluence running on the remote host is affected by a command injection vulnerability. A remote, unauthenticated attacker can use this to execute arbitrary code. Note that Nessus has not tested for this issue but has instead relied onl...