CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

CVE-2019-3397 affects Atlassian Bitbucket Data Center licensed instances where vulnerable versions precede the fixed releases: 5.13.x before 5.13.6, 5.14.x before 5.14.4, 5.15.x before 5.15.3, 5.16.x before 5.16.3, 6.0.x before 6.0.3, and 6.1.x before 6.1.2. The issue allows an authenticated user...

CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...

CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...

CVE-2019-11580

Atlassian Crowd/Crowd Data Center are affected by CVE-2019-11580 due to the pdkinstall development plugin being incorrectly enabled in release builds. The flaw permits attackers to install arbitrary plugins via unauthenticated or authenticated requests, enabling remote code execution on vulnerabl...

CVE-2019-11580

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits...

Password Cracker: Webapps

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from various web applications. Atlassian uses PBKDF2-HMAC-SHA1 which is 12001 in hashcat. PHPass uses phpass which is 400 in hashcat. Mediawiki is MD5 based and is 3711 in hashcat. Apache Superset, some...

Atlassian Jira 7.13.x < 7.13.4, 8.0.x < 8.0.4, 8.1.x < 8.1.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is potentially affected by multiple vulnerabilities: - A directory traversal vulnerability exists in the CachingResourceDownloadRewriteRule class due to an ineffective path access check. ...

Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection

The Widget Connector macro in Atlassian Confluence Server before version 6.6.12, 6.7.0 6.12.3, 6.13.0 6.13.3 and 6.14.0 6.14.2 allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. This...

Atlassian Crowd and Atlassian Crowd Data Center Command Execution Vulnerabilities

Atlassian Crowd and Atlassian Crowd Data Center are both products of Atlassian Australia.Atlassian Crowd is a web-based single sign-on system. The system provides authentication, authorization and other features for multi-user, web applications and directory servers.Atlassian Crowd Data Center is...

Atlassian Crowd 2.1.x < 3.0.5 / 3.1.x < 3.1.6 / 3.2.x < 3.2.8 / 3.3.x < 3.3.5 / 3.4.x < 3.4.4 RCE Vulnerability

The version of Atlassian Crowd installed on the remote host is 2.1.x prior to 3.0.5, 3.1.x prior to 3.1.6, 3.2.x prior to 3.2.8, 3.3.x prior to 3.3.5 or 3.4.x prior to 3.4.4. It is, therefore, affected by a remote code execution RCE vulnerability. An unauthenticated, remote attacker can exploit...

Atlassian Jira Cross-Site Scripting Vulnerability (CNVD-2019-32329)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A cross-site scripting vulnerability exists in the 'searchOwnerUserName parameter' parameter in Atlassian Jira versions prior to...

Atlassian Jira Information Disclosure Vulnerability (CNVD-2019-32323)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in Atlassian Jira versions prior to 7.13.3 and 8.x versions prior to 8.1.1, which...

Atlassian Jira Username Enumeration Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A username enumeration vulnerability exists in Atlassian Jira versions prior to 7.13.3, 8.0.4, and 8.1.1, which can be exploited...

Atlassian Jira Authorization Bypass Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira versions prior to 7.13.4, prior to 8.0.4, and prior to 8.1.1. An attacker can...

Atlassian JIRA Information Disclosure Vulnerability (CNVD-2019-15739)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in the CachingResourceDownloadRewriteRule class in Atlassian Jira versions prior to 7.13.4, prio...

Atlassian JIRA Server-Side Request Forgery (SSRF) Vulnerability (JRASERVER-68527)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.6.10 or 7.7.x prior to 7.7.5 or 7.8.x prior to 7.8.5 or 7.9.x prior to 7.9.3 or 7.10.x prior 7.10.3 or 7.11.x prior to 7.11.3 or 7.12.x prior to 7.12.3 or 7.13.x prior to...

Atlassian JIRA Cross-Site Scripting (XSS) Vulnerability (JRASERVER-68614)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.6.11 or 7.7.x prior to 7.13.1. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it t...

Atlassian JIRA Cross-Site Scripting (XSS) Vulnerability (JRASERVER-68526)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.6.10 or 7.x.x prior to 7.12.4 or 7.13.x prior to 7.13.1. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied...