Security Bulletin: NVIDIA DCGM - August 2021

NVIDIA has released a software update for NVIDIA® Data Center GPU Manager DCGM. The update addresses security issues that may lead to privilege escalation, total loss of confidentiality and integrity, and complete denial of service. To protect your system, download and install the latest DCGM...

HPE Edgeline Infrastructure Management 安全漏洞

HPE Edgeline Infrastructure Management is a software from Hewlett-Packard HPE that is used in data center environments to manage Edge devices. A security vulnerability exists in HPE Edgeline Infrastructure Manager that could be exploited remotely to disclose sensitive information.HPE has provided...

Vulnerable version of XStream used in Jira Server and Data Center - CVE-2021-29505

Affected versions of Atlassian Jira Server and Data Center used versions of XStream that were vulnerable to security exploits including CVE-2021-29505|http://x-stream.github.io/CVE-2021-29505.html. The affected versions of Jira Server and Data Center are before version 8.18.0. Affected versions:...

CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability. The vulnerability allowed for...

Remote code execution

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability. The vulnerability allowed for...

CVE-2017-18113

Summary: CVE-2017-18113 affects Jira Server/Data Center prior to 8.18.1, where the DefaultOSWorkflowConfigurator can be manipulated via crafted workflows to trigger Remote Code Execution (RCE). The underlying issue involves unsafe OSWorkflow classes being used in workflows, allowing an attacker t...

Exploit for Missing Authorization in Atlassian Data_Center

CVE-2020-36287 The dashboard gadgets preference resource of th...

Remote code execution in workflow import - CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability which allowed for various...

PT-2021-8571 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.18.1 Description: The issue allows remote attackers to execute arbitrary code via a Remote Code Execution RCE vulnerability, by tricking a system administrator into importing a malicious...

Atlassian JIRA Server和Atlassian JIRA Data Center 代码注入漏洞

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. The system is used to track and manage all types of issues and defects on the job.Atlassian JIRA Data Center is the dat...

CVE-2020-36239

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

CVE-2020-36239

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

Deserialization of untrusted data

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

CVE-2020-36239

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

CVE-2020-36239

CVE-2020-36239 affects Jira Data Center, Jira Core Data Center, Jira Software Data Center (versions prior to 8.5.16 for 6.3.0 line, prior to 8.13.8 for 8.6.0 line, prior to 8.17.0 for 8.14.0 line) and Jira Service Management Data Center (prior to 4.5.16 for 2.0.2 line, prior to 4.13.8 for 4.6.0 l...

CVE-2020-36239

Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before 4.13.8, and from version 4.14.0 before 4.17....

DevSecOps Training - Data Center Attack: The Game

See what it’s like as a security decision maker in Data Center Attack: The Game. Will your decisions help save lives?...

Atlassian Jira Data Center / Jira Service Management Data Center Missing Authentication (2021-07-21)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is affected by a missing authentication flaw in its Ehcache RMI component. An unauthenticated, remote attacker could exploit this to bypass authentication and execute arbitrary code on an...

Reboot of PunkSpider Tool at DEF CON Stirs Debate

Researchers will release a reboot of a controversial tool that crawls the web to identify back-end vulnerabilities in websites in the hopes that companies will quickly fix them and reduce security risks. However, experts have mixed feelings about the tool called PunkSpider, created by the analyti...

All Access Is (or Should Be) Remote Access

With the transition to remote work, we often hear the term remote access used in unison. Typically, remote work application access is facilitated via a remote access mechanism and, presumably, local work application access is facilitated via a local access mechanism. But I argue that this...