Atlassian Confluence 6.14.x < 7.3.3 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.11 or 6.14.x 7.3.3. It is, therefore, affected by an improper authorization check vulnerability allowing remote attackers with administrator privileges to edit existing...

Atlassian Confluence 6.11.x < 6.13.10 Man-In-The-Middle

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.11.x 6.13.10, 6.14.x 6.15.10, 7.0.1 7.0.5 or 7.1.x 7.1.2. It is, therefore, affected by a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin. Note that t...

Atlassian Confluence 6.14.x < 6.15.10 Man-In-The-Middle

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.11.x 6.13.10, 6.14.x 6.15.10, 7.0.1 7.0.5 or 7.1.x 7.1.2. It is, therefore, affected by a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin. Note that t...

Atlassian Confluence 6.14.x < 6.15.8 Local File Disclosure

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 6.1.x /confluence/WEB-INF/ directory and it's subdirectories. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

Atlassian Confluence 6.14.x < 7.4.6 Arbitrary File Read

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.18, 6.14.x 7.4.6 or 7.5.x 7.8.3. It is, therefore, affected by an incorrect path access check vulnerability allowing unauthenticated remote attackers to read arbitrary...

Atlassian Confluence < 6.13.18 Arbitrary File Read

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.18, 6.14.x 7.4.6 or 7.5.x 7.8.3. It is, therefore, affected by an incorrect path access check vulnerability allowing unauthenticated remote attackers to read arbitrary...

Atlassian Confluence < 7.11.0 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior 7.11.0. It is, therefore, affected by the following vulnerabilities : - A blind Server-Side Request Forgery SSRF vulnerability in Team Calendars parameters. CVE-2020-29445 - A...

Atlassian Confluence < 7.4.0 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.0. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in the docreatepagetemplate.action template. Note that the scanner has not tested for these issu...

Atlassian Confluence < 7.4.2 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.2 or 7.5.x 7.5.2. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in user macro parameters. Note that the scanner has not tested for these issues b...

Atlassian Confluence 7.5.x < 7.5.2 Cross-Site Scripting

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.2 or 7.5.x 7.5.2. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in user macro parameters. Note that the scanner has not tested for these issues b...

Atlassian Confluence < 6.13.6 Information Disclosure

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.6, 6.14.x 6.15.5 or 7.0.x 7.0.1. It is, therefore, affected by a missing permissions check vulnerability allowing remote attackers to obtain information about configured...

Atlassian Confluence < 7.2.0 Denial of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.2.0. It is, therefore, affected by a denial of service DoS vulnerability in the avatar upload feature. Note that the scanner has not tested for these issues but has instead...

Atlassian Confluence < 7.4.5 Template Injection

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.4.5 or 7.5.x 7.5.1. It is, therefore, affected by an injection vulnerability in custom user macros allowing remote attackers with system administration permissions to bypas...

Atlassian Confluence < 6.13.11 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.11 or 6.14.x 7.3.3. It is, therefore, affected by an improper authorization check vulnerability allowing remote attackers with administrator privileges to edit existing...

Atlassian Confluence 6.14.x < 6.15.5 Information Disclosure

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.6, 6.14.x 6.15.5 or 7.0.x 7.0.1. It is, therefore, affected by a missing permissions check vulnerability allowing remote attackers to obtain information about configured...

Atlassian Confluence < 5.8.6 Server-Side Request Forgery

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 5.8.6. It is, therefore, affected by a blind Server-Side Request Forgery SSRF vulnerability in the widgetconnector plugin. Note that the scanner has not tested for these issu...

Atlassian Confluence < 7.0.1 Improper Authorization

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.0.1. It is, therefore, affected by a missing authorization check vulnerability in the Atlassian Troubleshooting and Support Tools ATST plugin prior to version 1.17.2 which...

Attachment name, in questions/answers, is searchable despite not having Permissions for Questions

h4. Summary The questions plugin allows administrators to restrict its usage to groups/users, similar to Confluence Permissions. Attachments uploaded to these questions/answers can be found by users that do not have Questions Permission. However, while the attachment can be searched and its title...

Attachment name, in questions/answers, is searchable despite not having Permissions for Questions

h4. Summary The questions plugin allows administrators to restrict its usage to groups/users, similar to Confluence Permissions. Attachments uploaded to these questions/answers can be found by users that do not have Questions Permission. However, while the attachment can be searched and its title...

Atlassian Bugs Could Have Led to 1-Click Takeover

Atlassian, a platform used by 180,000 customers to engineer software and manage projects, could have been hijacked with a single click due to security flaws, researchers have disclosed. On Thursday, Check Point Research CPR published a report PDF outlining how an attacker could have exploited the...