Atlassian Jira Authenticated Upload Code Execution

This module can be used to execute a payload on Atlassian Jira via the Universal Plugin ManagerUPM. The module requires valid login credentials to an account that has access to the plugin manager. The payload is uploaded as a JAR archive containing a servlet using a POST request against the UPM...

Atlassian Confluence < 6.4.2 issuesURL Parameter Reflected XSS (CVE-2017-18086)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.4.2. It is, therefore, affected by a reflected cross-site scripting vulnerability in multiple resources that use the issuesURL parameter. Note that Nessus has not tested fo...

Atlassian Confluence < 6.6.1 viewdefaultdecorator Reflected XSS (CVE-2017-18085)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.6.1. It is, therefore, affected by a reflected cross-site scripting vulnerability in the viewdefaultdecorator resource. Note that Nessus has not tested for this issue but h...

Race condition

Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service NULL pointer dereference and thread crash via a state manipulation attack...

CVE-2015-6569

The vulnerability CVE-2015-6569 affects Atlassian Floodlight Controller’s LoadBalancer module. The issue is a race condition in the LoadBalancer component present in Floodlight Controller versions before 1.2, which can be triggered remotely by an attacker via standard network interaction to cause...

CVE-2015-6569

Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service NULL pointer dereference and thread crash via a state manipulation attack...

CVE-2017-18095

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...

CVE-2017-18093

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

Cross site scripting

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

CVE-2017-18095

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...

CVE-2017-18093

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

Authorization

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...

Cross site scripting

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...

CVE-2017-18095

CVE-2017-18095 affects Atlassian Crucible prior to 4.5.1 and prior to 4.6.0. The vulnerability is an improper authorization that allows remote attackers to comment on snippets they should not access. A fix exists in the 4.5.x series (4.5.1+) and in 4.6.0+. Organizations using Crucible should upgr...

CVE-2017-18093

This CVE affects Atlassian Fisheye and Crucible: before versions 4.4.3 (for 4.4.x line) and before 4.5.0 are vulnerable. The issue is a cross-site scripting (XSS) vulnerability in the location setting of a configured repository, exploitable by remote attackers who have permission to add or modify...

CVE-2017-18093

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the location...

CVE-2017-18095

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...