The vulnerability of the Git Bitbucket Server and Data Center-based code deployment, management, and collaboration tools lies in insufficient validation of input data, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Git Bitbucket Server and Data Center-based code deployment, management, and collaboration tools is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-004)

The version of ansible installed on the remote host is prior to 2.9.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-004 advisory. A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by...

org.apache.velocity Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.21.0, 7.21.1, 7.21.2, 7.21.3, 7.21.4, 7.21.5, 7.21.6, and 7.21.7 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

Medium: ansible

Issue Overview: A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by nolog feature when using the snmpfacts module. Attackers could take advantage of this information to steal the SNMP credentials. The highest threat from this...

Vulnerability fixed in Atlassian Bitbucket

Atlassian has fixed a vulnerability in Bitbucket. A malicious party could exploit the vulnerability to execute arbitrary code execute arbitrary code, possibly with elevated privileges. For successful abuse, the malicious party must be authenticated. Atlassian has released updates to fix the...

RCE (Remote Code Execution) in Bitbucket Data Center and Server - CVE-2022-1471

h2. Summary of Vulnerability Multiple Atlassian Data Center and Server Products use the SnakeYAML library for Java, which is susceptible to a deserialization flaw that can lead to RCE Remote Code Execution. i Atlassian Cloud sites are not affected by this vulnerability. If your site is accessed...

CVE-2023-22513

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

CVE-2023-22513

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

Remote code execution

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

CVE-2023-22513

CVE-2023-22513 is a high-severity remote code execution vulnerability in Bitbucket Data Center/Server, introduced in v8.0.0. An authenticated attacker can execute arbitrary code with high impact on confidentiality, integrity, and availability, with no user interaction. Fixed versions are specifie...

CVE-2023-22513

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

Bitbucket Data Center and Server Security Vulnerability

Bitbucket Data Center and Server is a data management center from Bitbucket, Inc. A security vulnerability exists in Bitbucket Data Center and Server version 8.0.0. An attacker can exploit the vulnerability to execute arbitrary code...

PT-2023-5577 · Atlassian · Bitbucket Data Center/Server +1

Name of the Vulnerable Software and Affected Versions: Bitbucket Data Center and Server versions 8.0.0 through 8.9.4 Bitbucket Data Center and Server versions 8.10.0 through 8.10.4 Bitbucket Data Center and Server versions 8.11.0 through 8.11.3 Bitbucket Data Center and Server versions 8.12.0...

CVE-2023-22513: Improper Control of Generation of Code

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

FALSE POSITIVE - OpenSearch Vulnerability in Bitbucket Data Center and Server

Notice of FALSE POSITIVE After review, it has been determined that CVE-2022-41906 DOES NOT affect ANY version of Bitbucket Data Center or Bitbucket Server. We have updated our bulletin and Jira tickets to reflect this update. We have taken action to prevent this false-positive from appearing in o...

RCE (Remote Code Execution) in Bitbucket Data Center and Server

This High severity RCE Remote Code Execution vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to...

GHSA-VRPG-C7C4-8MPX SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...

SSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...

CVE-2023-41937

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...

CVE-2023-41937

Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 both inclusive trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by...