628 matches found
XSS in the usermacros resource through the description of a macro - CVE-2017-18084
The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro. Acknowledgements Atlassian would like to credit Veit Hailperin @fenceposterro...
XSS in the editinword resource through the contents of an uploaded file - CVE-2017-18083
The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of an uploaded file...
CVE-2017-18084: Improper Neutralization of Input During Web Page Generation
The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro...
CVE-2017-18083: Improper Neutralization of Input During Web Page Generation
The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of an uploaded file...
CVE-2017-18085: Improper Neutralization of Input During Web Page Generation
The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...
CVE-2017-18086: Improper Neutralization of Input During Web Page Generation
Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the issuesURL parameter...
PT-2018-6662
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.4.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability through the contents of an uploaded file, specifically targetin...
PT-2018-6663
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.3.4 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro in the usermacros...
PT-2018-6664
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.6.1 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. This is achieved through the key parameter in the...
PT-2018-6665
Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.4.2 Description: A cross site scripting XSS issue exists, allowing remote attackers to inject arbitrary HTML or JavaScript. This is achieved via the issuesURL parameter. Recommendations: For...
REST API - Improved HTTP Authentication
h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is a simple resource that help administrators to perform operations that would take some time of their day to day activities in a couple seconds, instead of a couple minutes. I...
REST API - Improved HTTP Authentication
h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is a simple resource that help administrators to perform operations that would take some time of their day to day activities in a couple seconds, instead of a couple minutes. I...
CVE-2016-4317
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
CVE-2016-4317
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
Cross site scripting
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
CVE-2016-4317
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
CVE-2016-4317: Improper Neutralization of Input During Web Page Generation
Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page...
PT-2017-8471
Name of the Vulnerable Software and Affected Versions Atlassian Confluence Server versions prior to 5.9.11 Description The issue is related to a cross-site scripting XSS problem. It affects the viewmyprofile.action page. Recommendations For versions prior to 5.9.11, update to version 5.9.11 or...
Information Exposure in JUnit Report Macro
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-52112. panel The JUnit Report Macro throws different error messages for the url parameter code:java file:///no/file/herecode...
XSS Vulnerability in wiki markup
panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-51825. panel Luke Jahnke of the Australia Post Digital Mailbox Security Team reported to Atlassian an XSS in nesting various...