PT-2022-8970 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Server and Data Center versions prior to 7.4.5 Confluence Server and Data Center versions 7.5.0 through 7.6.3 Confluence Server and Data Center versions 7.7.0 through 7.7.4 Description: The Livesearch macro in Confluence Server and...

The vulnerability of the Questions for Confluence application on the Atlassian Confluence Server and the Confluence Data Center, related to the possibility of using strictly encrypted user credentials, allows a hacker to gain full access to the Confluence software with the confluence-users group’s permissions.

The vulnerability of the Questions for Confluence application on the Atlassian Confluence Server web server and the Confluence Data Center is related to the possibility of using strictly encrypted user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, t...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 A remote attacker can construct OGNL expressi...

This ticket is to request backporting fix from JRASERVER-73593 into 8.20.x LTS version

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers without permission to view a private project to view the project's issue creation meta information via a Broken Access Control vulnerability in the /issue/createmeta endpoint. The affected LTS version ...

Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability

Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affecting the Questions For Confluence app for Confluence Server and Confluence Data Center. The flaw, tracked as CVE-2022-26138, arises when the app in question is enable...

CVE-2022-20860

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus...

CVE-2022-20860 Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus...

Cisco Nexus Dashboard SSL Certificate Validation Vulnerability

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus...

Atlassian Confluence Server 信任管理问题漏洞

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server and Data Center that stems from the...

Atlassian Crowd和Atlassian Jira 授权问题漏洞

Atlassian Crowd and Atlassian Jira are both products of Atlassian Australia.Atlassian Crowd is a web-based single sign-on system. The system provides authentication, authorization and other functions for multiple users, web applications and directory servers.Atlassian Jira is a defect tracking...

CVE-2022-26138

The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit...

Atlassian Crowd和Atlassian Jira 访问控制错误漏洞

Atlassian Crowd and Atlassian Jira are both products of Atlassian Australia.Atlassian Crowd is a web-based single sign-on system. The system provides authentication, authorization and other functions for multiple users, web applications and directory servers.Atlassian Jira is a defect tracking...

The Mail Handler creates tickets from incoming emails in the wrong projects

The mail handler in Jira Service Management JSM Server and Data Center 4.22.5 incorrectly maps new incoming emails to the wrong JSM project, instead of the project linked to the mailbox the mails were sent to. If JSM is configured to process emails and create tickets in a restricted-access projec...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 by 1vere$k Just simple PoC for the Atlassian Ji...

The JSM Mail Handler functionality creates tickets from incoming emails in wrong projects

h3. Issue Summary When multiple Jira Service Management JSM projects are configured with a Mail Handler|https://confluence.atlassian.com/servicemanagementserver/receiving-requests-by-email-939926303.html via Project Settings Email Requests, the following issue happens: - the JSM Mail Handler...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CV...

The vulnerability of Schneider Electric Data Center Expert, a monitoring software for equipment information, stems from insufficient protection of registration data. This allows attackers to gain full control over the monitoring software.

The vulnerability of the Schneider Electric Data Center Expert software monitoring tool for equipment information is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain full control over the software...

The vulnerability of the mobile plugin for data processing in Atlassian Jira Server and Data Center allows a perpetrator to execute an SSRF attack.

The vulnerability of the mobile plugin for data processing in Atlassian Jira Server and Data Center is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

The vulnerability of Schneider Electric Data Center Expert, a monitoring software for equipment information, stems from insufficient protection of registration data. This allows attackers to gain full control over the monitoring software.

The vulnerability of the Schneider Electric Data Center Expert software monitoring tool for equipment information is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to gain full control over the software...

The vulnerability of the Schneider Electric Data Center Expert software lies in its ability to restore unreliable data into memory, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Schneider Electric Data Center Expert monitoring software relates to the restoration of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially created data...