Lucene search
+L

731074 matches found

OSV
OSV
•added 2026/09/22 8:36 p.m.•8 views

GHSA-HGCF-4MQ8-5266 MCP Atlassian: SSRF Protection Bypass

Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...

8.8CVSS5.9AI score0.00324EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
•added 2026/09/22 8:36 p.m.•7 views

MCP Atlassian: SSRF Protection Bypass

Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...

8.8CVSS5.9AI score0.00324EPSS
SaveExploits1References6Affected Software1
Github Security Blog
Github Security Blog
•added 2026/09/22 8:36 p.m.•7 views

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

8.8CVSS6.4AI score0.0053EPSS
SaveExploits1References6Affected Software1
OSV
OSV
•added 2026/09/22 8:36 p.m.•8 views

GHSA-6VMQ-24H2-PJ7J MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

8.3CVSS6.4AI score0.0053EPSS
SaveExploits1References6
OSV
OSV
•added 2026/09/22 8:36 p.m.•5 views

GHSA-5WF4-JQXH-8GM3 mcp-atlassian has an incomplete SSRF remediation

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

8.3CVSS5.7AI score0.00335EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
•added 2026/09/22 8:36 p.m.•9 views

mcp-atlassian has an incomplete SSRF remediation

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

8.3CVSS5.7AI score0.00335EPSS
SaveExploits0References6Affected Software1
Kitploit
Kitploit
•added 2026/09/22 8:35 p.m.•14 views

CVE-2022-0847-DirtyPipe

title: CVE-2022-0847 DirtyPipe Local Privilege Escalation Vulnerability Analysis date: 2022-03-08 14:41:20 tags: - Linux Privilege Escalation categories: - Security Research Vulnerability Description CVE-2022-0847 is a vulnerability in the Linux kernel since version 5.8, allowing an attacker to...

7.8CVSS7.1AI score0.92795EPSS
SaveExploits102References3
OSV
OSV
•added 2026/09/22 8:35 p.m.•8 views

GHSA-G2R2-3J32-J27X MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

5.4CVSS5.9AI score0.00248EPSS
SaveExploits1References5
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•9 views

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

6.1CVSS5.9AI score0.00248EPSS
SaveExploits1References5Affected Software1
OSV
OSV
•added 2026/09/22 8:35 p.m.•9 views

GHSA-P6HP-93WP-FH6P MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...

8.6CVSS6AI score0.00538EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•10 views

MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4)

Summary mcp-atlassian exposes an MCP tool confluenceuploadattachment whose filepath argument is passed directly to openfilepath, "rb" without any path validation. An attacker able to invoke the tool can read arbitrary files readable by the server process and exfiltrate them into a multipart uploa...

9CVSS6.3AI score0.01529EPSS
SaveExploits1References5Affected Software1
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•7 views

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Summary The OAuth token fallback file storage in OAuthConfig.savetokenstofile creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obtain...

5.5CVSS6AI score0.00111EPSS
SaveExploits0References5Affected Software1
OSV
OSV
•added 2026/09/22 8:35 p.m.•8 views

GHSA-4596-2P6P-28CV MCP Atlassian: Insecure File Permissions on OAuth Token Storage

Summary The OAuth token fallback file storage in OAuthConfig.savetokenstofile creates token files containing access tokens, refresh tokens, and cloud IDs with default filesystem permissions typically 0644 on Linux, world-readable. Any local user on a shared system can read these files to obtain...

5.5CVSS6AI score0.00111EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•6 views

MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

7.7CVSS6AI score0.00392EPSS
SaveExploits0References5Affected Software1
OSV
OSV
•added 2026/09/22 8:35 p.m.•6 views

GHSA-6CR4-CCF3-X7H4 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

Summary Missing path validation in confluenceuploadattachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...

7.7CVSS6AI score0.00392EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•7 views

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...

8.5CVSS5.8AI score0.00321EPSS
SaveExploits1References6Affected Software1
OSV
OSV
•added 2026/09/22 8:35 p.m.•9 views

GHSA-6529-C226-H328 MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...

7.1CVSS5.8AI score0.00321EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•9 views

MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

6.5CVSS6.2AI score0.00374EPSS
SaveExploits1References6Affected Software1
OSV
OSV
•added 2026/09/22 8:35 p.m.•6 views

GHSA-F26R-J276-GGG4 MCP Atlassian: Arbitrary File Read via Upload Attachment Tools

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The uploadattachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validatesafepath...

6.5CVSS6.2AI score0.00374EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
•added 2026/09/22 8:35 p.m.•10 views

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

Summary The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validateurlforssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS...

5.9CVSS5.9AI score0.00261EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder