CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

Command injection

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

CVE-2017-8768

CVE-2017-8768 affects Atlassian SourceTree v2.5c and earlier, with a command-injection flaw in the sourcetree:// URI handling that can trigger arbitrary OS commands when the URI contains substrings like sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext::. Multiple sources (SRCTREE-4738...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

Atlassian SourceTree 2.5c Client URL Handler Command Injection

Author: redrain, hongyu-sat360.cn Date: 2017-03-02 Version:2.5c and prior Platform: macOS, Windows, Linux Desktop Site: https://www.sourcetreeapp.com Vendor: Atlassian Vendor Notified: 2017-03-02 Technical Details: ======================================== SourceTree v2.5c and prior are affected b...

Atlassian Hipchat Server Remote Code Execution Vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia, which is used to track and manage all kinds of issues and defects in the workplace.HipChat is one of the plug-ins that provides group chat, file sharing, video chat and screen sharing features. A remote code execution...

Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ghostscript Type Confusion Arbitrary Command Execution', 'Description' = %q This module exploits a type confusion vulnerability in Ghostscript tha...

Atlassian Confluence Authentication Bypass Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing between team members. Atlassian Confluence suffers from an...

Authentication flaw

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...

CVE-2017-7415

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...

CVE-2017-7415

Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...

CVE-2017-7415

CVE-2017-7415 affects Atlassian Confluence 6.x up to but not including 6.0.7. Via the drafts diff REST resource, unauthenticated users (and in some setups even anonymous users) could bypass authentication and disclose the content of all blogs and pages by enumerating page or draft IDs. The issue ...

Ghostscript Type Confusion Arbitrary Command Execution

This module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript versions 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow. Module Options msf use...

Atlassian Confluence Information Disclosure Vulnerability

Atlassian Confluence is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Atlassian Resets HipChat Passwords Following Breach

Atlassian reset user passwords for its group chat service HipChat on Monday following an incident that may have resulted in unauthorized access to a server used by the service. The company began warning users Monday via email that as a result an attacker may have secured access to user informatio...

ColdFusion Hotfix Resolves XSS, Java Deserialization Bugs

Adobe today released an important security hotfix for several versions of its ColdFusion rapid web application development platform. The company said the update addresses an input validation vulnerability CVE-2017-3008 in the software that could be used in reflected cross-site scripting XSS...

Atlassian's HipChat Hacked — Users' Data May Have Been Compromised

Atlassian's group chat platform HipChat is notifying its users of a data breach after some unknown hacker or group of hackers broke into one of its servers over the weekend and stole a significant amount of data, including group chat logs. What Happened? According to a security notice published o...

Atlassian Bitbucket Detection (HTTP)

HTTP based detection of Atlassian Bitbucket. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Atlassian JIRA XXE / Deserialization Vulnerability

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. SPDX-FileCopyrightText: 2017...