CVE-2015-8398

Cross-site scripting XSS vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to rest/prototype/1/session/check...

Cross site scripting

Cross-site scripting XSS vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to rest/prototype/1/session/check...

Design/Logic Flaw

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to 1 spaces/viewdefaultdecorator.action or 2 admin/viewdefaultdecorator.action...

CVE-2015-8399

Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to 1 spaces/viewdefaultdecorator.action or 2 admin/viewdefaultdecorator.action...

CVE-2015-8399

This CVE affects Atlassian Confluence (before 5.8.17). The vulnerability is an information disclosure where a remote authenticated user can read configuration files via the decoratorName parameter to spaces/viewdefaultdecorator.action or admin/viewdefaultdecorator.action. The issue is caused by a...

CVE-2015-8398

CVE-2015-8398 is a cross-site scripting vulnerability in Atlassian Confluence (pre-5.8.17). An attacker can inject arbitrary scripts via the PATH_INFO to rest/prototype/1/session/check, allowing remote script/HTML execution. Affected versions are Atlassian Confluence Server 5.8.x earlier than 5.8...

CVE-2015-8398

Cross-site scripting XSS vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to rest/prototype/1/session/check...

Responses with Set-Cookie header cached

h3. Context We have Confluence running with SSO from Crowd. Confluence is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get...

Responses with Set-Cookie header cached

h3. Context We have Confluence running with SSO from Crowd. Confluence is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get...

Atlassian Confluence Information Disclosure Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. Atlassian Confluence has a security vulnerability that allows remote attackers to exploit the vulnerability by submitting special requests to obtain...

Atlassian Confluence Cross-Site Scripting Vulnerability

Atlassian Confluence is a professional enterprise knowledge management and collaboration software that can also be used to build enterprise WiKi. Atlassian Confluence suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious...

Atlassian Confluence XSS and Insecure Direct Object Reference Vulnerabilities

Atlassian Confluence is prone to cross site scripting and insecure direct object reference vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Atlassian Confluence 5.2 / 5.8.14 / 5.8.15 - Multiple Vulnerabilities

Exploit for php platform in category web applications Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product Descripti...

Atlassian Confluence 5.2/5.8.14/5.8.15 - Multiple Vulnerabilities

Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product Description Confluence is team collaboration software, where yo...

Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities

Atlassian Confluence 5.25.8.145.8.15 - Multiple Vulnerabilities Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product...

Atlassian Confluence XSS / Insecure Direct Object Reference

Systems Affected Product : Confluence Company : Atlassian Versions 1 : 5.2 / 5.8.14 / 5.8.15 CVSS Score 1 : 6.1 / Medium classified by vendor Versions 2 : 5.9.1 / 5.8.14 / 5.8.15 CVSS Score 2 : 7.7 / High classified by vendor Product Description Confluence is team collaboration software, where yo...

confluence.org XSS vulnerability

Vulnerable URL: http://confluence.org/confvisitlist.php?titletext=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 667755 Google Pageran...

Check CSRF security in watch/unwatch action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-39719. panel Check CSRF security in watch/unwatch action...

Insecure Direct Object Reference

The following URL is vulnerable to Insecure Direct Object Reference, allowing any authenticated user to read configuration files from the application such as the content of webapp directory in confluence. http:///spaces/viewdefaultdecorator.action?decoratorName=...

Insecure Direct Object Reference

The following URL is vulnerable to Insecure Direct Object Reference, allowing any authenticated user to read configuration files from the application such as the content of webapp directory in confluence. http:///spaces/viewdefaultdecorator.action?decoratorName=...