2944 matches found
Restricted JIRA comments appear in Confluence notification inbox
If a user is watching a JIRA issue, and a restricted comment is made on that issue that the user should not be able to see, the notification still appears in their Confluence notification inbox. When the user navigates to the issue, the correctly are not allowed to see the comment. This is a...
Security vulnerability in apache commons fileupload
Apache commons-fileupload 1.3.1 was released this weekend with a fix for CVE-2014-0050, involving a DoS attack when using specially crafted multipart requests. We need to determine if Confluence is vulnerable, and if so, upgrade to this version of the library...
Security vulnerability in apache commons fileupload
Apache commons-fileupload 1.3.1 was released this weekend with a fix for CVE-2014-0050, involving a DoS attack when using specially crafted multipart requests. We need to determine if Confluence is vulnerable, and if so, upgrade to this version of the library...
Security vulnerability in apache commons fileupload
Apache commons-fileupload 1.3.1 was released this weekend with a fix for CVE-2014-0050, involving a DoS attack when using specially crafted multipart requests. We need to determine if Confluence is vulnerable, and if so, upgrade to this version of the library...
Confluence Administrator Can Add Himself to System Administrator Group
I have found what I believe to be a security bug in Confluence that should be fixed. We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators see attachment. The purpose was to give our Tech Writers the ability to access t...
Confluence Administrator Can Add Himself to System Administrator Group
I have found what I believe to be a security bug in Confluence that should be fixed. We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators see attachment. The purpose was to give our Tech Writers the ability to access t...
Confluence Administrator Can Add Himself to System Administrator Group
I have found what I believe to be a security bug in Confluence that should be fixed. We have System Administrator function from the Confluence Administrator Group, and created a new Group called System Administrators see attachment. The purpose was to give our Tech Writers the ability to access t...
JIRA sends in-app notifications to Confluence for restricted comments
If you have a primary application link between JIRA in Confluence, users get a notification in their Confluence workbox everytime someone comments in a ticket the user is watching. Users receive the notification with the text of the comment even when the comment is restricted to other groups,...
JIRA sends in-app notifications to Confluence for restricted comments
If you have a primary application link between JIRA in Confluence, users get a notification in their Confluence workbox everytime someone comments in a ticket the user is watching. Users receive the notification with the text of the comment even when the comment is restricted to other groups,...
JIRA sends in-app notifications to Confluence for restricted comments
If you have a primary application link between JIRA in Confluence, users get a notification in their Confluence workbox everytime someone comments in a ticket the user is watching. Users receive the notification with the text of the comment even when the comment is restricted to other groups,...
Whitelist or blacklist for inline attachment display
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-32204. panel Currently, there are three Attachment Download Security Policy: Default Insecure Secure !sample.png! It would be...
Whitelist or blacklist for inline attachment display
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-32204. panel Currently, there are three Attachment Download Security Policy: Default Insecure Secure !sample.png! It would be...
@mention Notification for Comments on Restricted Page in Confluence 5.4.x
In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...
@mention Notification for Comments on Restricted Page in Confluence 5.4.x
In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...
@mention Notification for Comments on Restricted Page in Confluence 5.4.x
In Confluence 5.4.x versions, the user is getting comment notifications in a page that he's restricted to view. If you restrict an user to view or edit the page through 'Tools Restrictions' and then comment in a page, the user will get the notification about it in the Workbox. h4.Steps to...
Cross Site Scripting vulnerabilities in Pickers
Currently, the confluence picker does not sanitize the input /crowd/console/secure/pickers/displayPicker.action. Proof of concept. Access the following URL in your browser with javascript enabled. Replace the with your crowd URL. panel...
Cross Site Scripting vulnerabilities in Pickers
Currently, the confluence picker does not sanitize the input /crowd/console/secure/pickers/displayPicker.action. Proof of concept. Access the following URL in your browser with javascript enabled. Replace the with your crowd URL. panel...
Secure Mail Archive with Space Permissions
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-31945. panel Mail Archives in a Space are currently not subject to any Read / View security context Permissions. They are visib...
Link Text of a Space Changed for User without Space View Permission
Link Text name of a Space changes into the Space key if viewed by a user without Space view permission for that specific Space. h6. Steps to reproduce Create a Space e.g.: Space name "TEST 1 - 3" with Space key "TES" with a Homepage that has the same name as the Space name In other public Space,...
Link Text of a Space Changed for User without Space View Permission
Link Text name of a Space changes into the Space key if viewed by a user without Space view permission for that specific Space. h6. Steps to reproduce Create a Space e.g.: Space name "TEST 1 - 3" with Space key "TES" with a Homepage that has the same name as the Space name In other public Space,...