Server side request forgery (ssrf)

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

CVE-2020-24897

The CVE-2020-24897 issue affects the Table Filter and Charts for Confluence Server app (Atlassian Confluence) prior to version 5.3.25. A vulnerability in the Table from CSV macro allows remote attackers to inject arbitrary HTML or JavaScript via cross-site scripting (XSS) through the Markdown mar...

CVE-2020-24897

The Table Filter and Charts for Confluence Server app before 5.3.25 for Atlassian Confluence allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS through the provided Markdown markup to the "Table from CSV" macro...

CVE-2020-24898

The CVE-2020-24898 vulnerability affects the Table Filter and Charts for Confluence Server app (Confluence Server) prior to version 5.3.26. The issue is an SSRF flaw exploitable via the Table from CSV macro URL parameter, stemming from how the macro processes the given URL. Impact described in co...

CVE-2020-24898

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

PT-2020-15852

Name of the Vulnerable Software and Affected Versions Table Filter and Charts for Confluence Server versions prior to 5.3.25 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS through the provided Markdown markup to the "Table from CS...

CVE-2020-24898: Server-Side Request Forgery (SSRF)

The Table Filter and Charts for Confluence Server app before 5.3.26 for Atlassian Confluence allows SSRF via the "Table from CSV" macro URL parameter...

CVE-2020-24897: Improper Neutralization of Input During Web Page Generation

The Table Filter and Charts for Confluence Server app before 5.3.25 for Atlassian Confluence allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting XSS through the provided Markdown markup to the "Table from CSV" macro...

PT-2020-15853

Name of the Vulnerable Software and Affected Versions Table Filter and Charts for Confluence Server versions prior to 5.3.26 Description The issue allows for Server-Side Request Forgery SSRF via the "Table from CSV" macro, specifically through a URL parameter. Recommendations For versions prior t...

Struts 2 CVE-2019-0230 and CVE-2019-0233 impact on Confluence

h3. Issue Summary Recently, Apache released the following report regarding two different vulnerabilities in Struts 2: |https://struts.apache.org/announce.htmla20200813 Is Confluence affected by these CVEs? h3. Steps to Reproduce Not applicable. h3. Expected Results Not applicable h3. Actual Resul...

An unauthenticated attacker can generate a sizeable CPU load on a Confluence server with a single request.

h3. Issue Summary Confluence has an API endpoint, which combines multiple js resources in a single response:...

Mail.ru: Открытый Confluence и доступы к чату операторов в Skype

Confluence opened to external network without authentication on city-mobil.ru...

TinyMCE XSS vulnerability on version 4.7.11

h4. Description It seems that Confluence bundles a version of TinyMCE within the editor that has an XSS vulnerability. Confluence version 7.4.1 uses version 0.4.34 of the confluence-editor plugin that includes 4.7.11 of TinyMCE as a dependency Confluence version 7.6.2 uses version 0.4.41 of the...

Atlassian Confluence < 7.4.2 / 7.5.x < 7.5.2 XSS (CONFSERVER-60102)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.2 or 7.5.x prior to 7.5.2. It is, therefore, affected by a cross-site scripting XSS vulnerability in user macro parameters. An authenticated, remote attacker can exploit...

Stored XSS in the Livesearch macro - CVE-2020-36290

The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting XSS...

Atlassian Confluence Server and Data Center Cross-Site Scripting Vulnerability

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi.Atlassian Confluence Data Center is the data center version of Atlassian Confluence. Atlassian...

Exploit for Path Traversal in Atlassian Confluence_Server

PoC exploit for CVE-2019-3396, a Confluence Server-Side Template Injection SSTI Remote Code Execution RCE vulnerability. The exploit targets Confluence versions vulnerable to this CVE. The vulnerability is exploited by sending a specially crafted request to the Confluence REST API, which allows a...

CVE-2020-14175

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2...

CVE-2020-14175

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2...

Cross site scripting

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2...