590 matches found
CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
CVE-2017-16858: Incorrect Authorization
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
PT-2018-6346
Name of the Vulnerable Software and Affected Versions: Atlassian Crowd versions 1.5.0 through 3.1.2 Description: The issue allows an attacker to impersonate a Crowd user in REST requests by authenticating to a directory bound to an application. This can occur when the Crowd application is bound t...
REST endpoint user impersonation using authentication module functionality - CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
REST endpoint user impersonation using authentication module functionality - CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
WordPress Crowd Ideas 1.0 Cross Site Scripting Vulnerability
WordPress Crowd Ideas plugin version 1.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable Crowd Ideas 1.0 Crowd Ideas is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage...
WordPress Crowd Ideas 1.0 Cross Site Scripting
Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Crowd Ideas 1.0 Crowd Ideas is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...
Crowdfunding Effort to Buy ShadowBrokers Exploits Shuts Down
Heeding the advice of attorneys, law enforcement and peers in the security industry, a crowdfunding campaign that spun up to purchase the next batch of ShadowBrokers leaks has been squashed. The group announced this week more details on its impending Dump of the Month Service in which it promises...
Users with the same name as an inactive user in a higher priority directory get all that users memberships
h3. Summary In embedded Crowd in at least JIRA and Confluence, when a user is made inactive but retains its groups, then if a lower priority directory has a new user created with the same name, it now inherits their memberships. It seems like the logic used to determine the user authentication by...
Atlassian Crowd 2.5.x < 2.5.4 Information Disclosure
Binary data 700020.prm...
Atlassian Crowd 2.6.x < 2.6.3 Information Disclosure
Binary data 700021.prm...
Online Malware & URL Analysis: MalSub
Online Malware & URL Analysis malsub is a Python 3.6.x framework that wraps several web services of online malware and URL analysis sites through their RESTful Application Programming Interfaces APIs . It supports submitting files or URLs for analysis, retrieving reports by hash values, domains,...
Atlassian Crowd Struts2 RCE Vulnerability (CWD-4879)
Atlassian Crowd is prone to a remote code execution RCE vulnerability in Struts2. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...
Apache Struts 2 Remote Code Execution (CVE-2017-5638)
Description Crowd used a version of Struts 2 that was vulnerable to CVE-2017-5638|https://cwiki.apache.org/confluence/display/WW/S2-045. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Crowd. Affected versions: All versions of...
Apache Struts 2 Remote Code Execution (CVE-2017-5638)
Description Crowd used a version of Struts 2 that was vulnerable to CVE-2017-5638|https://cwiki.apache.org/confluence/display/WW/S2-045. Attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of Crowd. Affected versions: All versions of...
Atlassian Crowd 2.x < 2.11.0 Information Disclosure
Binary data 9903.prm...
Atlassian Crowd < 2.5.2 Information Disclosure
Binary data 9901.prm...
Atlassian Crowd Detection
Binary data 9899.prm...