Numerous XSS Type 2 vulnerabilities in macros bundled with Confluence

'd like to report critical vulnerabilities in 3 of your macros - Column, Image, Block and Code macros. The vulnerabilities are classified as XSS Type 2 stored and the details with example exploits are in the pdfs attached. Because of similarity of the vulnerabilities assume that it is more than...

Numerous XSS Type 2 vulnerabilities in macros bundled with Confluence

'd like to report critical vulnerabilities in 3 of your macros - Column, Image, Block and Code macros. The vulnerabilities are classified as XSS Type 2 stored and the details with example exploits are in the pdfs attached. Because of similarity of the vulnerabilities assume that it is more than...

Reflected XSS Vulnerability in the Feed Builder

---- Input in the Feed Builder is not properly handled. Insert: code "alert'Gotcha!' code as the feed name title and you get url like this:...

Vulnerability against DoS attack at permission setting

Description: This bug is similar like this one: http://jira.atlassian.com/browse/CONF-8978. Exploit: Insert to the "Grant permission to" field x thousand comma without sapce...

Atlassian JIRA 3.4.2 - IssueNavigator.JSPA Cross-Site Scripting

source: https://www.securityfocus.com/bid/23244/info Atlassian JIRA is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

Atlassian JIRA 3.4.2 - IssueNavigator.JSPA Cross-Site Scripting

Atlassian JIRA 3.4.2 - IssueNavigator.JSPA Cross-Site Scripting source: https://www.securityfocus.com/bid/23244/info Atlassian JIRA is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue...

Atlassian JIRA 3.7.3 - BrowseProject.JSPA Cross-Site Scripting

source: https://www.securityfocus.com/bid/22503/info Atlassian JIRA is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user ...

Atlassian JIRA 3.7.3 - BrowseProject.JSPA Cross-Site Scripting

Atlassian JIRA 3.7.3 - BrowseProject.JSPA Cross-Site Scripting source: https://www.securityfocus.com/bid/22503/info Atlassian JIRA is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execut...

CVE-2006-3339

secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter, which displays the installation path and other system information in an error message...

CVE-2006-3338

Cross-site scripting XSS vulnerability in Atlassian JIRA 3.6.2-156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page...

CVE-2006-3339

The CVE-2006-3339 entry affects Atlassian JIRA, specifically the file path secure/ConfigureReleaseNote.jspa in version 3.6.2-#156. The underlying issue is unspecified manipulations of the projectId parameter, which leads to information disclosure by displaying the installation path and other syst...

CVE-2006-3338

Summary: CVE-2006-3338 describes a cross-site scripting (XSS) vulnerability in Atlassian JIRA 3.6.2-#156. An attacker could supply input in a direct request to secure/ConfigureReleaseNote.jspa that is not sanitized before being echoed in an error page, enabling injection of arbitrary web script o...

CVE-2006-3338

Cross-site scripting XSS vulnerability in Atlassian JIRA 3.6.2-156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to secure/ConfigureReleaseNote.jspa, which are not sanitized before being returned in an error page...

CVE-2006-3339

secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter, which displays the installation path and other system information in an error message...

Support nested groups

panel:title=Resolved in Confluence 3.5|borderStyle=solid|borderColor=3C78B5|titleBGColor=3C78B5|bgColor=E7F4FA We are pleased to advise that support for nested groups is available in Confluence 3.5. You can find instructions on how to configure nested groups in our documentation: Configuring User...

Support nested groups

panel:title=Resolved in Confluence 3.5|borderStyle=solid|borderColor=3C78B5|titleBGColor=3C78B5|bgColor=E7F4FA We are pleased to advise that support for nested groups is available in Confluence 3.5. You can find instructions on how to configure nested groups in our documentation: Configuring User...

CVE-2005-3967

Cross-site scripting XSS vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString search module parameter...

CVE-2005-3967

CVE-2005-3967 is an XSS vulnerability in Atlassian Confluence 2.0.1 Build 321. The issue affects the dosearchsite.action module, allowing remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString parameter. The documented impact is partial integrity compromise with n...

CVE-2005-3967

Cross-site scripting XSS vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary web script or HTML via the searchQuery.queryString search module parameter...