628 matches found
Blind SSRF in Team Calendars REST API using location parameter - CVE-2020-29445
Affected versions of Confluence Server allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters. Affected versions: 7.11.0 Fixed versions: 7.11.0 7.4.8 LTS This vulnerability is attributed to Stefano Castilletti, a...
Blind SSRF in Team Calendars REST API using location parameter - CVE-2020-29445
Affected versions of Confluence Server allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters. Affected versions: 7.11.0 Fixed versions: 7.11.0 7.4.8 LTS This vulnerability is attributed to Stefano Castilletti, a...
Blind SSRF in widgetConnector - CVE-2021-26072
Affected versions of Atlassian Confluence Server allow remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery SSRF vulnerability in the widgetconnector plugin. When running in an environment like Amazon EC2, this flaw may be used to access...
Blind SSRF in widgetConnector - CVE-2021-26072
Affected versions of Atlassian Confluence Server allow remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery SSRF vulnerability in the widgetconnector plugin. When running in an environment like Amazon EC2, this flaw may be used to access...
CVE-2020-29448
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect...
Persistent XSS through Team Calendar in Confluence Server - CVE-2020-29444
Affected versions of Team Calendar in Confluence Server allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting vulnerability in admin global setting parameters. h3. Affected versions: 7.11.0 h3. Fixed version: 7.11.0 This vulnerability is attributed to Stefano...
Persistent XSS through Team Calendar in Confluence Server - CVE-2020-29444
Affected versions of Team Calendar in Confluence Server allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting vulnerability in admin global setting parameters. h3. Affected versions: 7.11.0 h3. Fixed version: 7.11.0 This vulnerability is attributed to Stefano...
Atlassian Confluence Server and Confluence Data Center Security Vulnerabilities
Atlassian Confluence Server and Atlassian Confluence are both products of Atlassian Australia.Atlassian Confluence Server is the server version of a suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. Atlassian Confluence is ...
PT-2021-11667
Name of the Vulnerable Software and Affected Versions: Confluence Server versions prior to 6.13.18 Confluence Server versions 6.14.0 through 7.4.5 Confluence Server versions 7.5.0 through 7.8.2 Confluence Data Center versions prior to 6.13.18 Confluence Data Center versions 6.14.0 through 7.4.5...
CVE-2020-29448: Undefined Security Weakness
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect...
Exploit for Path Traversal in Atlassian Confluence_Server
cve-2019-3396 Unauthenticated Confluence RCE cve-2019-339...
Atlassian Confluence Server Code Issue Vulnerability
Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server versions prior to 7.2.0 that could...
CVE-2020-29450: Unrestricted Upload of File with Dangerous Type
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service DoS vulnerability in the avatar upload feature. The affected versions are before version 7.2.0...
Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448
The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 6.13.18 6.14.0 ≤ version 7.4....
CPU exhaustion caused by DoS against Confluence server by requesting static batch resources
The details of this issue can be viewed here: https://asecurityteam.atlassian.net/browse/VULN-170040 The source code is located at: https://bitbucket.org/atlassian/atlassian-plugins-webresource/src/master/...
CVE-2019-0230 - Apache Struts Potential Remote Code Execution Vulnerability [Confluence Server is not affected]
Atlassian Confluence Server and Data Center is not affected by CVE-2019-0230 Apache Struts Potential Remote Code Execution Vulnerability...
Atlassian Confluence XSS Vulnerability
Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi. An XSS vulnerability exists in the table filters and charts in the Confluence Server app, versions prior to 5.3.26,...
Atlassian Confluence SSRF Vulnerability
Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi. An SSRF vulnerability exists in the table filters and charts in the Confluence Server app, versions prior to 5.3.26,...
CVE-2020-24897
The Table Filter and Charts for Confluence Server app before 5.3.25 for Atlassian Confluence allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS through the provided Markdown markup to the "Table from CSV" macro...