Cross site scripting

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...

CVE-2016-4319

CVE-2016-4319 affects Atlassian Jira Server prior to 7.1.9. The issue is a Cross-Site Request Forgery (CSRF) in the /auditing/settings endpoint. According to the connected data, exploitation involves CSRF without authentication required, with user interaction needed (per CVSS) and high impact on ...

CVE-2016-4318

Summary: CVE-2016-4318 is an XSS vulnerability in Atlassian Jira Server prior to 7.1.9, triggered via the role name in /project/ViewDefaultProjectRoleActors.jspa. The issue arises from improper handling/validation of user-supplied input, enabling an attacker to inject HTML/JavaScript that could a...

CVE-2016-4317

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...

CVE-2016-4318

Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name...

CVE-2016-4319

Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...

CVE-2016-4320

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...

CVE-2016-4317

CVE-2016-4317 affects Atlassian Confluence Server up to version 5.9.10, with a cross-site scripting (XSS) vulnerability on the viewmyprofile.action page. Root cause: failure to adequately validate user-supplied data leading to persistent XSS (described as a persistent XSS in Atlassian records and...

CVE-2016-4320

CVE-2016-4320 affects Atlassian Bitbucket Server prior to 4.7.1. A directory traversal in the pull requests resource allows remote attackers to read the first line of an arbitrary file, leaking partial confidentiality. The issue is triggered via a directory traversal path and is limited to the fi...

CVE-2016-4320: Improper Limitation of a Pathname to a Restricted Directory

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...

CVE-2017-5983: Deserialization of Untrusted Data

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object...

PT-2017-8472

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Server versions prior to 7.1.9 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the project/ViewDefaultProjectRoleActors.jspa file via a role name. Recommendations For versions prior to 7.1.9,...

PT-2017-8473

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Server versions prior to 7.1.9 Description The issue concerns a CSRF problem in the auditing/settings of the software. There is also mention of vulnerabilities in Jira Work Management and Jira Software, but specific details abou...

PT-2017-8471

Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server versions prior to 5.9.11 Description The issue is related to a cross-site scripting XSS problem. It affects the viewmyprofile.action page. Recommendations For versions prior to 5.9.11, update to version 5.9.11 or...

CVE-2016-4318: Improper Neutralization of Input During Web Page Generation

Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name...

CVE-2016-4319: Cross-Site Request Forgery (CSRF)

Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...

CVE-2016-4317: Improper Neutralization of Input During Web Page Generation

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...

PT-2017-16807

Name of the Vulnerable Software and Affected Versions Atlassian JIRA Server versions prior to 6.3.0 Description The issue is related to the improper use of an XML parser and deserializer in the JIRA Workflow Designer Plugin. This allows remote attackers to execute arbitrary code, read arbitrary...

Java AMF3 deserialization vulnerability analysis-vulnerability warning-the black bar safety net

AMF Action Message Format is a binary serialization format, before the main Flash application in using this format. Recently, the Code White found to have multiple Java AMF library in the presence of vulnerabilities, and these vulnerabilities will lead to unauthenticated remote code execution...

AMF3 Java implementations deserialization Vulnerability

Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...