CVE-2012-6342: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests that logout the user via a comment...

PT-2014-2382

Name of the Vulnerable Software and Affected Versions Atlassian Confluence version 3.4.6 Description A cross-site request forgery CSRF issue exists in the logout.action of Atlassian Confluence, allowing remote attackers to hijack the authentication of administrators for requests that logout the...

ClassLoader manipulation vulnerability

We have fixed a vulnerability in our fork of Apache Struts. Attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. The attacker needs to be able to access the Crowd web interface. In cases when anonymous access is enabled, a valid user...

Self Stored Cross site scripting

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47188. panel Product: http://swag.atlassian.com Vulnerability Type: Self Stored Cross site scripting Cross site scripting...

Self Stored Cross site scripting

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47188. panel Product: http://swag.atlassian.com Vulnerability Type: Self Stored Cross site scripting Cross site scripting...

Self Stored Cross site scripting

Product: http://swag.atlassian.com Vulnerability Type: Self Stored Cross site scripting Cross site scripting Platform: Leaptop / PC URL: https://id.atlassian.com/profile/signUp.action?continue=http://swag.atlassian.com/Login.aspx OS/Version: Windows 7 Browser: Mozilla Firefox v 28 Status: NEW...

Self Stored Cross site scripting

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47188. panel Product: http://swag.atlassian.com Vulnerability Type: Self Stored Cross site scripting Cross site scripting...

JIRA Issues Collector Directory Traversal

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'JIRA Issues Collector Directory Traversal', 'Description' = %q This module exploits a directory traversal flaw in JIRA 6.0.3. The...

Atlassian JIRA < 6.1.4 Privilege Escalation

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to 6.1.4. It is, therefore, potentially affected by a privilege escalation vulnerability, which allows a remote, unauthenticated attacker to commit actions on behalf of any...

Atlassian JIRA < 6.0.5 Multiple Vulnerabilities

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to version 6.0.5. It is, therefore, potentially affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists in the Admin Panel due to a failure to sanitiz...

Atlassian JIRA < 6.0.4 Arbitrary File Creation

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to version 6.0.4. It is, therefore, potentially affected by an arbitrary file creation vulnerability due to a flaw in the Issue Collector plugin in which the 'filename' POST...

Atlassian JIRA Issue Collector插件目录遍历漏洞

CVE ID:CVE-2014-2314 Atlassian JIRA是一款基于J2EE技术的项目问题跟踪以及管理软件。 Atlassian JIRA Issue Collector插件存在目录遍历漏洞，允许远程攻击者利用漏洞创建任意文件。 0 Atlassian JIRA 厂商补丁： Atlassian ----- Atlassian JIRA 6.0.4已经修复该漏洞，建议用户下载更新： https://www.atlassian.com...

Atlassian JIRA Issue Collector插件目录遍历漏洞

CVE ID:CVE-2014-2313 Atlassian JIRA是一款基于J2EE技术的项目问题跟踪以及管理软件。 Atlassian JIRA Issue Collector插件存在目录遍历漏洞，允许远程攻击者利用漏洞创建任意文件。 0 Atlassian JIRA 厂商补丁： Atlassian ----- Atlassian JIRA 6.0.4已经修复该漏洞，建议用户下载更新： https://www.atlassian.com...

CVE-2014-2313

Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors...

Directory traversal

Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors...

CVE-2014-2313

Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors...

CVE-2014-2314

CVE-2014-2314 affects Atlassian Jira’s Issue Collector in versions prior to 6.0.4. The vulnerability is a directory traversal flaw in the Issue Collector component, driven by insufficient validation of the filename parameter, allowing a remote attacker to create arbitrary files. Several connected...

CVE-2014-2314

Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors...

CVE-2014-2313

CVE-2014-2313 is a directory traversal vulnerability in the Importers plugin of Atlassian JIRA prior to 6.0.5. It allows remote attackers to create arbitrary files via unspecified vectors without authentication (CVSS v2 base score 4.3). Public docs confirm the affected product is JIRA and the iss...