Atlassian Confluence Data Center And Server Authentication Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control', 'Description' = %q This module exploits a broken...

Atlassian Confluence 7.20.x < 8.5.5 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.18, 7.20.x prior to 8.5.5 or 8.7.x prior to 8.7.2. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested fo...

Atlassian Confluence Data Center and Server - Authentication Bypass Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Atlassian Confluence Data Center and Server Authentication Bypass via Broken Access Control', 'Description' = %q This module exploits a broken...

Atlassian Confluence 8.7.x < 8.7.2 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.19.18, 7.20.x prior to 8.5.5 or 8.7.x prior to 8.7.2. It is, therefore, affected by a stored Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested fo...

Exploit for Injection in Atlassian Confluence_Data_Center

Project Introduction This project refers to the project of B...

Exploit for Improper Input Validation in Atlassian Confluence_Data_Center

CVE-2023-22515 How does this detection method work? Th...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence. A authenticated malicious party could exploit the vulnerability to perform execute a stored cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the browser of the victim, or access sensitive information in the...

Atlassian Confluence < 7.19.19 / < 8.5.6 / < 8.8.0 XSS (CONFSERVER-94513)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-94513 advisory. - This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS...

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center’s date center, related to the lack of protective measures for the website structure, allows attackers to execute arbitrary code.

The vulnerability of the Atlassian Confluence Server web server and the Confluence Data Center is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

Cross site scripting

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. This Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

CVE-2024-21678

CVE-2024-21678 is a stored XSS vulnerability in Atlassian Confluence Data Center and Server introduced in 2.7.0. An authenticated attacker can inject HTML/JavaScript that runs in a victim’s browser, with high confidentiality impact, low integrity impact, no availability impact, and no user intera...

PT-2024-1778 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center versions 2.7.0 through 8.7.1 Confluence Data Center versions 8.6.0 through 8.6.1 Confluence Data Center versions 8.5.0 through 8.5.4 LTS Confluence Data Center versions 8.4.0 through 8.4.5 Confluence Data Center version...

Atlassian Confluence Security Vulnerability

Atlassian Confluence is a suite of specialized enterprise knowledge management and collaboration software from Atlassian Australia that can also be used to build enterprise WiKi. A security vulnerability exists in Atlassian Confluence Data Center and Server that stems from the presence of stored...

Path Traversal in Confluence Data Center

This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. This Path Traversal vulnerability, with a CVSS Score of 8.3, allows an unauthenticated attacker to exploit an undefinable vulnerability which has high impact to confidentiality, high impact...

CISA Warning: Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a now-patched security flaw impacting Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD software to its Known Exploited Vulnerabilities KEV catalog, following reports that it's being likely...

RCE to Sliver: IR Tales from the Field

Rapid7 Incident Response consultants Noah Hemker, Tyler Starks, and malware analyst Tom Elkins contributed analysis and insight to this blog. Rapid7 Incident Response was engaged to investigate an incident involving unauthorized access to two publicly-facing Confluence servers that were the sourc...