CVE-2021-26068

An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability...

Sql injection

An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability...

Design/Logic Flaw

The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it...

CVE-2020-36232

CVE-2020-36232 affects the atlassian-gadgets plugin used by Atlassian Jira Server/Data Center. The vulnerability arises from MessageBundleWhiteList handling that allowed unexpected DNS lookups and requests to arbitrary services by obtaining the application base URL from the executing HTTP request...

CVE-2020-36232

The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it...

Jira atlassian-gadgets Code Issue Vulnerability

Jira atlassian-gadgets is an application plugin for the Jira community in the United States. It provides the ability to personalize the dashboard display by changing its color and changing other preferences to suit your needs. A security vulnerability exists in atlassian-gadgets, which originates...

Atlassian JIRA Server 注入漏洞

Atlassian JIRA Server is the server version of a defect tracking management system from Atlassian Australia. The system is mainly used for tracking and managing all kinds of issues and defects in the workplace. Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 suffer...

Vulnerability fixed in Atlassian Bitbucket

By placing a specially crafted DLL file in the Bitbucket installation directory, an unauthorized user can execute arbitrary code with SYSTEM privileges on a Windows system on which the vulnerable Bitbucket software is installed. Atlassian has released updates to fix the vulnerability. fix. For mo...

Atlassian JIRA < 8.5.11 / 8.6.x < 8.13.3 / 8.14.x < 8.14.1 Information Disclosure (JRASERVER-72000)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is affected by an information disclosure vulnerability. A remote, authenticated attacker can exploit this to enumerate Jira projects in the Jira Projects plugin report page. Note that...

Atlassian JIRA < 8.13.2 / 8.14.x < 8.14.1 Information Disclosure (JRASERVER-71950)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this to view custom fields and custom SLA names in the mobile site view. Note that...

CVE-2020-36233

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory...

CVE-2020-36233

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory...

Design/Logic Flaw

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory...

CVE-2021-26068

An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability...

CVE-2021-26068

CVE-2021-26068 affects the Atlassian Jira Server for Slack plugin, with vulnerable versions from 0.0.3 up to, but not including, 2.0.15. The issue is a template injection vulnerability in the plugin's endpoint that allows remote attackers to execute arbitrary code. Impact is high (C / I / A all h...

CVE-2020-36233

CVE-2020-36233 affects Atlassian Bitbucket on Windows where the Windows Installer creates weak ACLs in the installation directory, enabling local privilege escalation. Affected Bitbucket Server/Data Center installers include all versions prior to 6.10.9, 7.x prior to 7.6.4, and 7.7.0 up to 7.10.0...

CVE-2020-36233

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory...

Atlassian Bitbucket on Windows is vulnerable to privilege escalation due to weak ACLs

Overview Atlassian Bitbucket on Windows fails to properly set ACLs, which can allow an unprivileged Windows user to run arbitrary code with SYSTEM privileges. Description The Atlassian Bitbucket Windows installer fails to set a secure access-control list ACL on the default installation directory,...

Atlassian Asterisk Path Traversal Vulnerability

Atlassian Asterisk is a software application from the American company Atlassian. It provides a development program bug tracking feature. A security vulnerability exists in Asterisk. The vulnerability originates from a Hold/Unhold request that could cause a denial of service by causing a fatal...

DOM XSS in the issue navigation & search view via parameter pollution - CVE-2020-36288

The issue navigation & search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting XSS vulnerability caused b...