4978 matches found
Jira Atlassian File Attachment Download
Exploit for multiple platform in category web applications ======================================= Jira Atlassian File Attachment Download ======================================= Exploit Title: Jira Atlassian Date: 28/3/2010 Author: Ignacio Garrido Mail: Ign.sec gmail com Software Link:...
Version number
I notice that the JIRA footer displays the current version of JIRA. Revealing the specifics of the revisions of software that you run in production is generally considered a bad security practice. Is there a reason that it is displayed openly to all users in licensed versions of the product? Is i...
Version number
I notice that the JIRA footer displays the current version of JIRA. Revealing the specifics of the revisions of software that you run in production is generally considered a bad security practice. Is there a reason that it is displayed openly to all users in licensed versions of the product? Is i...
Changing system locale means users with non-ASCII characters in their passwords cannot authenticate
The OSUser and Atlassian-User authenticators used by Confluence convert a password into bytes before hashing it. This conversion doesn't specify which encoding should be used, so the system's default encoding is used. If the system administrator changes the locale settings on the server or change...
Changing system locale means users with non-ASCII characters in their passwords cannot authenticate
The OSUser and Atlassian-User authenticators used by Confluence convert a password into bytes before hashing it. This conversion doesn't specify which encoding should be used, so the system's default encoding is used. If the system administrator changes the locale settings on the server or change...
XSS bug when unfavouriting a dashboard
When unfavouriting a dashboard with name 'alert'blah';' the javascript is executed. https://extranet.atlassian.com/display/QA/JIRA+Dashboards+Blitz+-+Mark%27s+Findings...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...
CVE-2008-6832
Cross-site request forgery CSRF vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the 1 fullname Full Name parameter in the ViewProfile page or 2 returnUrl parameter in a form, as demonstrated using...
CVE-2008-6831
Multiple cross-site scripting XSS vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the 1 fullname Full Name parameter in the ViewProfile page or 2 returnUrl parameter in a form, as demonstrated using...
CVE-2008-6832
Cross-site request forgery CSRF vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...
CVE-2008-6832
Technical details about CVE-2008-6832 are not publicly available in the provided documents; no concrete affected product/version, impact, or fix is stated. Monitor for updates.
CVE-2008-6831
The CVE-2008-6831 entry describes multiple cross-site scripting (XSS) vulnerabilities in Atlassian Jira Enterprise Edition 3.13, allowing remote attackers to inject arbitrary script or HTML via the fullname parameter on the ViewProfile page or the returnUrl parameter in a form (secure/AddComment)...
CVE-2008-6831
Multiple cross-site scripting XSS vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the 1 fullname Full Name parameter in the ViewProfile page or 2 returnUrl parameter in a form, as demonstrated using...
Atlassian JIRA < 3.13.3 DWR 'c0-id' XSS
The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting XSS vulnerability due to a failure to sanitize input to the 'c0-id' parameter during a DWR call. A remote attacker, using a crafted URL, can exploit this to execute JavaScript in a user's browser...
Atlassian JIRA < 3.13.3 Multiple Vulnerabilities
Binary data 4983.prm...
Design/Logic Flaw
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...
CVE-2008-6531
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...
CVE-2008-6531
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."...