An Atlassian product has a security vulnerability.

Affected versions of Atlassian Confluence Server allow remote authenticated attackers to view sensitive information in the hidden attachments of custom content on reindexing via an Information Disclosure vulnerability in the search page. The affected versions are before version 7.13.12, from...

Atlassian Crowd 3.x / 4.x < 4.4.4 / 5.x < 5.0.3 Security Bypass (CWD-5888)

The version of Atlassian Crowd installed on the remote host is 3.x, 4.x prior to 4.4.4, or 5.x prior to 5.0.3. It is, therefore, affected by a security bypass vulnerability due to security misconfiguration. An unauthenticated, remote attacker can exploit this by authenticating as the crowd...

Insight JAMF integration - Error when Importing

h3. Issue Summary The Assets - Jamf Integration|https://marketplace.atlassian.com/apps/1219908/assets-jamf-integration?tab=overview&hosting=datacenter plugin supported by Atlassian seems to retrieve an error on the importing process "could not connect to service". h3. Steps to Reproduce The...

inDrive: Full access to InDrive jira panel via exposed API token

The Jira API token was exposed in a GitHub repository, allowing unauthorized access to the InDrive Atlassian panel and sensitive information stored in Jira...

The vulnerability of the REST application programming interface of the Atlassian Crowd data processing software allows a perpetrator to enhance their privileges.

The vulnerability of the REST application interface of the Atlassian Crowd data processing software is related to errors during the authentication process. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

Atlassian Bitbucket 8.1.x < 8.1.5 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 7.7.x < 7.17.12 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 8.0.x < 8.0.5 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 7.18.x < 7.21.6 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Crowd < 4.4.4 Misconfiguration

According to its self-reported version number, the Atlassian Crowd application running on the remote host is affected by a misconfiguration vulnerability. This vulnerability allows an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call...

Atlassian Bitbucket < 7.6.19 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 8.2.x < 8.2.4 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Bitbucket 8.4.x < 8.4.2 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Crowd 5.0.x < 5.0.3 Misconfiguration

According to its self-reported version number, the Atlassian Crowd application running on the remote host is affected by a misconfiguration vulnerability. This vulnerability allows an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call...

Atlassian Bitbucket 8.3.x < 8.3.3 Command Injection

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This...

Atlassian Addresses Issues in Crowd and Bitbucket Products

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Atlassian has two security holes that can be abused to allow arbitrary code execution. CVE-2022-43782 allows an intruder connecting from an IP address on the allow list to authenticate as the crow...

Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

Australian software company Atlassian has rolled out security updates to address two critical flaws affecting Bitbucket Server, Data Center, and Crowd products. The issues, tracked as CVE-2022-43781 and CVE-2022-43782, are both rated 9 out of 10 on the CVSS vulnerability scoring system...

CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...

CVE-2022-43782

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...

Path traversal

Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the usermanagement path. This vulnerability can only be exploited by IPs specified under the...