CVE-2022-36804

CVE-2022-36804 Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability CVE-2022-36804 In affected versions of Atlassian Bitbucket Server and Data Center a Command Injection Vulnerability exists in multiple API endpoints where an attacker with access to a public repository or...

Snyk Scan

Bitbucket Pipelines Pipe: Snyk This pipe uses Snyk to find, fix and monitor known vulnerabilities in your app dependencies and docker image. YAML Definition Add the following snippet to the script section of your bitbucket-pipelines.yml file: root@kitploit: - pipe: snyk/snyk-scan:1.0.2 variables:...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Ejecución Remota de Comandos en Bitbucket RCE Análisis Técnico y Explotación en Laboratorio de Inyección de Argumentos con Byte Nulo Resumen de la Vulnerabilidad CVE-2022-36804 es una vulnerabilidad de Inyección de Argumentos alta/crítica dentro de la API REST de Atlassian Bitbuck...

sonarcloud-scan

Bitbucket Pipelines Pipe: SonarQube Cloud scan Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages. Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for...

bitbucket-test

Contenedor Docker para investigar CVE-2022-36804 Recreando una vulnerabilidad de ejecución remota de código donde Bitbucket no sanitiza la entrada del usuario, lo que permite a los atacantes inyectar flags de Git y ejecutar código de forma remota. Este repositorio documenta cómo reproduje la...

bitbucket-iac-scan

Bitbucket Security: Infrastructure as Code Security Scanner Scans your Infrastructure as Code configuration files to ensure good security practises. Creates a security Code Insights report if issue is found. This Bitbucket Cloud supported Pipe leverages the industry leading KICS scanning tool to...

CVE-2022-36804-ReverseShell

Original Project https://github.com/BenHays142/CVE-2022-36804-PoC-Exploit CVE-2022-36804-PoC-Exploit A somewhat reliable PoC exploit for CVE-2022-36804 BitBucket Critical Command Injection. This attack generally requires public repos to be enabled, however session cookies are also compatible with...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

Summary The OpenChoreo autobuild webhook endpoint POST /api/v1alpha1/autobuild selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component's configuration, and its Bitbucket provider accepted requests without a val...

EUVD-2026-58546

OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion webhook signature bypass...

cve-2022-36804

CVE-2022-36804: RCE sin autenticación en Atlassian Bitbucket Server Se encontró una vulnerabilidad crítica de inyección de comandos en múltiples endpoints de API de Atlassian Bitbucket Server y Data Center. Esta vulnerabilidad afecta a todas las versiones de Bitbucket Server y Data Center lanzada...

cve-2022-36804

Atlassian Bitbucket RCE PoC - CVE-2022-36804 Este repositorio contiene un script PoC simple para la vulnerabilidad de ejecución remota de código de Atlassian Bitbucket. Puedes ejecutar este script simplemente con los siguientes comandos: root@kitploit: echo 'bitbucket.redacted.com' | python3...

CVE-2022-36804

CVE-2022-36804 RCE en Bitbucket 2022 Este repositorio es parte de hgrab-framework dork title: "Public Repositories - Bitbucket" Productos afectados root@kitploit: - Bitbucket Server y Data Center 7.6 anteriores a 7.6.17 - Bitbucket Server y Data Center 7.17 anteriores a 7.17.10 - Bitbucket Server...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in the ansible module, where credentials are disclosed in the console logs by default, and are not protected by security features when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucket Pipeline credentials. The greatest threat posed ...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

DoS (Denial of Service) minimatch Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.4.22, 10.2.5, 10.3.0, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

DoS (Denial of Service) brace-expansion Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.1, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.3, 10.2.0, 10.3.0, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) brace-expansion Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.1, 10.2.0, 10.3.2, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...