4999 matches found
CVE-2016-4318
Summary: CVE-2016-4318 is an XSS vulnerability in Atlassian Jira Server prior to 7.1.9, triggered via the role name in /project/ViewDefaultProjectRoleActors.jspa. The issue arises from improper handling/validation of user-supplied input, enabling an attacker to inject HTML/JavaScript that could a...
CVE-2016-4319
CVE-2016-4319 affects Atlassian Jira Server prior to 7.1.9. The issue is a Cross-Site Request Forgery (CSRF) in the /auditing/settings endpoint. According to the connected data, exploitation involves CSRF without authentication required, with user interaction needed (per CVSS) and high impact on ...
CVE-2016-4320
Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource...
CVE-2016-4317
CVE-2016-4317 affects Atlassian Confluence Server up to version 5.9.10, with a cross-site scripting (XSS) vulnerability on the viewmyprofile.action page. Root cause: failure to adequately validate user-supplied data leading to persistent XSS (described as a persistent XSS in Atlassian records and...
CVE-2016-4319
Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings...
CVE-2016-4318
Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name...
CVE-2016-4317
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
Java AMF3 deserialization vulnerability analysis-vulnerability warning-the black bar safety net
AMF Action Message Format is a binary serialization format, before the main Flash application in using this format. Recently, the Code White found to have multiple Java AMF library in the presence of vulnerabilities, and these vulnerabilities will lead to unauthenticated remote code execution...
AMF3 Java implementations deserialization Vulnerability
Details reference: https://codewhitesec.blogspot.kr/2017/04/amf.html Some Java implementations of AMF3 deserializers derive class instances from java. io. Externalizable rather than the AMF3 specification's recommendation of a flash. utils. IExternalizable. A remote attacker with the ability to...
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
Overview Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references. Description Several Java implementations of Action Message Format AMF3 are vulnerable to one or more of the following implementation errors:CWE-502: Deserialization of...
Atlassian Crowd 2.5.x < 2.5.4 Information Disclosure
Binary data 700020.prm...
Atlassian Crowd 2.6.x < 2.6.3 Information Disclosure
Binary data 700021.prm...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344...
Atlassian Crowd Struts2 RCE Vulnerability (CWD-4879)
Atlassian Crowd is prone to a remote code execution RCE vulnerability in Struts2. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progr...
Atlassian Bamboo Struts2 RCE Vulnerability
Atlassian Bamboo is prone to a remote code execution RCE vulnerability in Struts2. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
XSS Vulnerability in wiki markup
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-51825. panel Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various...
XSS Vulnerability in wiki markup
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-51825. panel Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various...