Cross site scripting

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

CVE-2023-36662

The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This affects User Management for Jira 2.0.0 through 2.17.1, User Management for Confluence 2.0.0 through 2.15.24, and User Management for Bitbucket 2.2.2 through 2.15.24...

PT-2023-25665 · Atlassian · User Management For Bitbucket +2

Name of the Vulnerable Software and Affected Versions: User Management for Jira versions 2.0.0 through 2.17.1 User Management for Confluence versions 2.0.0 through 2.15.24 User Management for Bitbucket versions 2.2.2 through 2.15.24 Description: The TechTime User Management components for Atlassi...

@backstage/plugin-scaffolder-backend (>=0.0.0-nightly-2021712211 <=0.15.24-next.0), @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (>=0.0.0-nightly-20230325022054 <=0.0.0-nightly-20230801022410) +8 more potentially affected by CVE-2023-35926 via @backstage/plugin-scaffolder-backend (>=0.0.0-nightly-20220708025041 <=0.18.0)

@backstage/plugin-scaffolder-backend NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-2021712211, =0.0.0-nightly-20230325022054, =0.0.0-nightly-2022122206, =0.0.0-nightly-2022122206, =0.0.0-nightly-20230112022659, =0.0.0-nightly-2022122206, =1.0.8, =1.0.0, =1.0.0, =2.2.0 -...

Page restrictions are not inherited for pages created from Templates

h3. Issue Summary Page restrictions are not inherited to child pages if the child page is created via Templates e.g Meeting notes template. This is reproducible on Data Center: yes h3. Steps to Reproduce Create a page and apply page restriction for some user View and edit restriction Create a chi...

CVE-2023-33287

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

CVE-2023-33287

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

CVE-2023-33287

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

PT-2023-24270 · Atlassian · Confluence Inline Table Editing

Name of the Vulnerable Software and Affected Versions: Confluence Inline Table Editing versions prior to 3.8.0 Description: A stored cross-site scripting issue allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables. Recommendations: For versions...

CVE-2023-33287

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

CVE-2023-33287

The CVE-2023-33287 entry concerns Atlassian Confluence’s Inline Table Editing prior to version 3.8.0. The vulnerability is a stored XSS that allows an attacker to inject and execute arbitrary JavaScript via a crafted payload into tables. Affected component: Inline Table Editing (Confluence). Root...

CVE-2023-33287

A stored cross-site scripting XSS vulnerability in the Inline Table Editing application before 3.8.0 for Confluence allows attackers to store and execute arbitrary JavaScript via a crafted payload injected into the tables...

Atlassian Confluence < 7.19.9 (CONFSERVER-83218)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-83218 advisory. A remote attacker, authenticated with read permissions, can upload attachments despite not having permissions to due to a broken access control...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence. A authenticated malicious person with read-only privileges can exploit the exploit the vulnerability to upload files in places where the malicious party is not authorized to do. Atlassian has released updates to fix the vulnerability in Confluenc...

CVE-2023-22504

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature...

CVE-2023-22504

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature...

CVE-2023-22504

CVE-2023-22504 affects Atlassian Confluence Server. Affected versions allow remote attackers with read permissions (not write) to upload attachments due to a Broken Access Control in the attachments feature. The issue is evidenced across multiple sources referencing Confluence Server prior to ver...

CVE-2023-22504

Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature...