2941 matches found
Atlassian Confluence Access Restriction Bypass Vulnerability
Atlassian Confluence is prone to an access restriction bypass vulnerability using watch notifications. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Atlassian Confluence 6.1.1 Access Restriction Bypass
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Access Restriction Bypass product: Atlassian Confluence vulnerable version: 4.3.0 - 6.1.1 fixed version: 6.2.1 CVE number: - impact: Medium homepage:...
PermissionHelper is sending incorrect data
h3 summary Permissionhelper didn't send right results for user who should be able to change permissions h3.Environment Confluence 6.1.3 h3. Steps to reproduce 1. Create a group in Active Directory named "app-confluence-space-keyuser", and add some users i.e "test" 2. Create a group in Active...
Access Restriction Bypass using watch notifications (CVE-2017-9505)
Confluence did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it...
Access Restriction Bypass using watch notifications (CVE-2017-9505)
Confluence did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which contain the content of comments, for comments added to a page after they started watching it...
Other SD Projects Knowledge Base are accessible through direct link
h3. Summary: If a Customer only able to access one SD Portal and log in to Confluence, it is actually possible for that Customer to access other SD Project KBs through a Direct URL Link including navigating the space. h3. Steps to Reproduce: Prepare a JIRA instance that is connected to Confluence...
Other SD Projects Knowledge Base are accessible through direct link
h3. Summary: If a Customer only able to access one SD Portal and log in to Confluence, it is actually possible for that Customer to access other SD Project KBs through a Direct URL Link including navigating the space. h3. Steps to Reproduce: Prepare a JIRA instance that is connected to Confluence...
Atlassian Confluence 'viewmyprofile.action' Cross-Site Scripting Vulnerability
Atlassian Confluence is a professional wiki program. It is a knowledge management tool through which collaboration and knowledge sharing among team members can be realized. A cross-site scripting vulnerability exists in Atlassian Confluence 'viewmyprofile.action', which stems from the program...
Security Issue: REST API does not respect 'Allow Anonymous Access to Remote API' setting on pages that has anonymous access
h3. Summary Anonymous API access are allowed on on pages that has Anonymous View Permission, even though the 'Allow Anonymous Access to Remote API' setting not ticked h3. Steps to Reproduce Make sure that 'Allow Anonymous Access to Remote API' setting from Confluence Administration Security...
Security Issue: REST API does not respect 'Allow Anonymous Access to Remote API' setting on pages that has anonymous access
h3. Summary Anonymous API access are allowed on on pages that has Anonymous View Permission, even though the 'Allow Anonymous Access to Remote API' setting not ticked h3. Steps to Reproduce Make sure that 'Allow Anonymous Access to Remote API' setting from Confluence Administration Security...
Atlassian Confluence 6.0.x < 6.0.7 Drafts diff REST Information Disclosure
According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.0.x prior to 6.0.7. It is, therefore, affected by an information disclosure vulnerability in the Confluence drafts diff REST resource due to making available the page IDs or draft I...
Atlassian Confluence Authentication Bypass Vulnerability
Atlassian Confluence is a professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing between team members. Atlassian Confluence suffers from an...
CVE-2017-7415
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...
Authentication flaw
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...
CVE-2017-7415
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...
CVE-2017-7415
CVE-2017-7415 affects Atlassian Confluence 6.x up to but not including 6.0.7. Via the drafts diff REST resource, unauthenticated users (and in some setups even anonymous users) could bypass authentication and disclose the content of all blogs and pages by enumerating page or draft IDs. The issue ...
CVE-2017-7415
Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource...
Atlassian Confluence Information Disclosure Vulnerability
Atlassian Confluence is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Confluence 6.0.x Information Disclosure Vulnerability
The Confluence drafts diff rest resource made the current content of all blogs and pages in Confluence available without authentication. Attackers who can access the Confluence web interface of a vulnerable version can use this vulnerability to obtain the content of all blogs and pages inside...