CVE-2022-36804

CVE-2022-36804 RCE en Bitbucket 2022 Este repositorio es parte de hgrab-framework dork title: "Public Repositories - Bitbucket" Productos afectados root@kitploit: - Bitbucket Server y Data Center 7.6 anteriores a 7.6.17 - Bitbucket Server y Data Center 7.17 anteriores a 7.17.10 - Bitbucket Server...

Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804 A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions 7.6.17, 7.17.10, 7.21.4...

CVE-2022-36804

CVE-2022-36804 The Bitbucket Server and Bitbucket Data Center components have a command injection vulnerability, according to information recently discovered by the Sangfor security team. An attacker can submit malicious HTTP requests to execute arbitrary code and eventually get access to the...

CVE-2022-36804-MASS-RCE

CVE-2022-36804-POC Una vulnerabilidad crítica CVE-2022-36804 en Atlassian Bitbucket Server y Data Center podría ser explotada por atacantes no autorizados para ejecutar código malicioso en instancias vulnerables. versiones afectadas Todas las versiones de Bitbucket Server y Data Center lanzadas...

CVE-2022-36804

CVE-2022-36804 - Vulnerabilidad de Inyección de Comandos en Atlassian Bitbucket Server y Data Center ⚠️ Solo con fines educativos y de investigación de seguridad autorizada Autores del Exploit Original Muy agradecido al autor original del PoC Walnut Security Services Pvt. Ltd Descripción Varios...

cve-2022-36804

CVE-2022-36804：Atlassian Bitbucket Server 中的预认证 RCE 在 Atlassian Bitbucket Server 和 Data Center 的多个 API 端点中发现了一个严重命令注入漏洞。该漏洞影响所有版本低于 、、、、、 和 的 Bitbucket Server 和 Data Center。 CVE-2022-36804 实验环境 构建 Docker root@kitploit: docker build -t bitbucket . 运行 Docker root@kitploit: docker run -it bitbucket...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

EUVD-2026-80762

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92138

Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier is vulnerable in its OAuth authorization endpoint , which reads the oauth_callback URL from the user-submitted form instead of the server-side stored request token. This allows an attacker to hijack the OAuth flow and obtain an access ...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

cve-2022-36804

CVE-2022-36804 Bitbucket PoC Este repositorio contiene un script de explotación en Python para la vulnerabilidad CVE-2022-36804 de Atlassian Bitbucket Server/Data Center. El problema es una falla de inyección de comandos en el flujo de archivado de Git, donde los parámetros prefix manipulados...

CVE-2022-36804

CVE-2022-36804 PoC Este repositorio contiene un exploit simple de prueba de concepto para la reciente vulnerabilidad de ejecución remota de código en BitBucket CVE-2022-36804. La explotación de esta vulnerabilidad requiere acceso a un repositorio en la instancia objetivo; si no tienes credenciale...

CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability CVE-2022-36804 In affected versions of Atlassian Bitbucket Server and Data Center a Command Injection Vulnerability exists in multiple API endpoints where an attacker with access to a public repository or...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Ejecución Remota de Comandos en Bitbucket RCE Análisis Técnico y Explotación en Laboratorio de Inyección de Argumentos con Byte Nulo Resumen de la Vulnerabilidad CVE-2022-36804 es una vulnerabilidad de Inyección de Argumentos alta/crítica dentro de la API REST de Atlassian Bitbuck...

bitbucket-test

Contenedor Docker para investigar CVE-2022-36804 Recreando una vulnerabilidad de ejecución remota de código donde Bitbucket no sanitiza la entrada del usuario, lo que permite a los atacantes inyectar flags de Git y ejecutar código de forma remota. Este repositorio documenta cómo reproduje la...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bitbucket Data Center

This High severity org.bouncycastle:bcprov-jdk18on Dependency vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0 of Bitbucket Data Center and Server. This Cryptographic Failure vulnerability, with a CVSS Score of 8.9 and a CVSS Vector of code:java...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the unconditional disabling of SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint. An attacker can...

EUVD-2026-38770

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to...

CVE-2026-57289

Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections sending Bearer token authenticated requests to the configured Bitbucket Server endpoint, allowing attackers able to intercept network traffic to...

PT-2026-51799

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Push and Pull Request Plugin versions prior to 3.3.9 Description The plugin unconditionally disables SSL/TLS certificate and hostname validation when sending Bearer token authenticated requests to the configured Bitbucket...