4896 matches found
Atlassian JIRA Remote Code Execution Vulnerability
Atlassian JIRA is a project and transaction tracking tool from Atlassian. The Atlassian JIRA Workflow Designer plug-in does not properly use XML parsers and parallelizers, which can be exploited by remote attackers to submit special serialized Java objects, execute arbitrary code, read arbitrary...
Code injection
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object...
CVE-2017-5983
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object...
CVE-2017-5983
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object...
CVE-2017-5983
The vulnerability CVE-2017-5983 affects Atlassian JIRA Server versions 4.2.4–6.3.0 via the JIRA Workflow Designer plugin. It stems from improper XML parsing/deserialization of AMF3 data, allowing unauthenticated remote code execution, file reading, or DoS through crafted serialized Java objects. ...
CVE-2017-5983
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object...
CVE-2016-4317
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
CVE-2016-4319
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...
CVE-2016-4318
Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name...
CVE-2016-4319
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...
CVE-2016-4320
Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...
Cross site scripting
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
Cross site scripting
Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name...
Cross site request forgery (csrf)
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...
Directory traversal
Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...
CVE-2016-4317
CVE-2016-4317 affects Atlassian Confluence Server up to version 5.9.10, with a cross-site scripting (XSS) vulnerability on the viewmyprofile.action page. Root cause: failure to adequately validate user-supplied data leading to persistent XSS (described as a persistent XSS in Atlassian records and...
CVE-2016-4319
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...
CVE-2016-4318
Summary: CVE-2016-4318 is an XSS vulnerability in Atlassian Jira Server prior to 7.1.9, triggered via the role name in /project/ViewDefaultProjectRoleActors.jspa. The issue arises from improper handling/validation of user-supplied input, enabling an attacker to inject HTML/JavaScript that could a...
CVE-2016-4319
CVE-2016-4319 affects Atlassian Jira Server prior to 7.1.9. The issue is a Cross-Site Request Forgery (CSRF) in the /auditing/settings endpoint. According to the connected data, exploitation involves CSRF without authentication required, with user interaction needed (per CVSS) and high impact on ...