The vulnerability of the pre-viewing function for macros in Atlassian Confluence Server and the date of the Confluence Data Center, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the preview function for macros on Atlassian Confluence Server and the Confluence Data Center is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected informati...

Unauthorised users who make multipart requests have this data written to disk momentarily

h3. Issue Summary When a multipart request is made to a Confluence server, the multipart data is usually saved to a temporary directory prior to determining whether a user is authorised to access that URL. This is due to both application and library WebWork/Struts design where permission checks...

CVE-2023-22503

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...

CVE-2023-22503

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...

Information disclosure

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...

CVE-2023-22503

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...

CVE-2023-22503

Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Roj...

CVE-2023-22503

The CVE concerns Atlassian Confluence Server/Data Center where the macro preview feature permits an Information Disclosure vulnerability. Affected: Confluence Server/Data Center versions before 7.13.15, 7.14.0–7.19.7, and 7.20.0–8.2.0. Impact: anonymous remote attackers can view names of attachme...

Atlassian Confluence Server 安全漏洞

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management features and support for building enterprise WiKi. A security vulnerability exists in Atlassian Confluence Server and Data Center. An attacker could...

A user with read permissions to a Confluence page is able to upload attachments - CVE-2023-22504

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature. The affected versions are before version 7.13.17, fro...

PT-2023-4888

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M2 through 11.0.0-M4 Apache Tomcat versions 10.1.5 through 10.1.7 Apache Tomcat versions 9.0.71 through 9.0.73 Apache Tomcat versions 8.5.85 through 8.5.87 Bamboo Data Center and Server version 8.1.12 and later,...

Atlassian Confluence 7.13.9 < 7.13.12 Embedded Spring-Beans Denial Of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.9 prior to 7.13.12, 7.19.0 prior to 7.19.3. It is, therefore, affected by a Denial of Service DoS attack vulnerability when relying on attacker controlled data binding to set a...

Atlassian Confluence < 7.13.14 / 7.14.x < 7.19.6 / 7.20.x < 8.1.0 (CONFSERVER-82436)

The version of Atlassian Confluence installed on the remote host is affected by an information disclosure vulnerability in the Synchrony service. An unauthenticated, remote attacker can exploit this to view sensitive information. Note that Nessus has not tested for this issue but has instead reli...

Atlassian Confluence < 7.4.10 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Confluence 7.1.x < 7.12.3 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.10 or 7.5.0 prior to 7.12.3. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows allow authenticated local...

Atlassian Confluence 6.4.3 < 6.6.1 Resource Attachment Content Spoofing

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.6.1. It may, therefore, permit remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of...

Atlassian Confluence 4.3.x < 6.2.1 Access Restriction Bypass using watch notifications

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.2.1. It is, therefore, affected by access restriction bypass using watch notifications which may permit an attacker to receive workbox notifications containing the...

Atlassian Confluence 7.1.x < 7.1.1 DLL Hijacking

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.5 or 7.1.x prior to 7.1.1. It therefore may be affected by a weakness when deployed onto the Windows operating system environment allows local system attackers who have...

Atlassian Confluence 7.5.x < 7.11.6 RCE Via OGNL Injection

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an attacker...

Atlassian Confluence 6.4.1 < 6.5.2 Cross-Site Scripting Via RSS macro

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.5.2. It is, therefore, affected by a flaw in the RSS Feed macro handling in Atlassian Confluence which may permit remote attackers to inject arbitrary HTML or...