Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

Improper Authorization org.springframework.security:spring-security-core Dependency in Crowd Data Center and Server

This High severity org.springframework.security:spring-security-core Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This org.springframework.security:spring-security-core Dependency vulnerability, with a CVSS Score of 8.2 and a CVSS...

Jira redirects the users back to the login page when SSO is used with Crowd

h3. Issue Summary Jira redirects the users back to the login page when SSO is used with Crowd when SSOSeraphAuthenticator is enabled in the seraph-config.xml. It works fine when Crowd is not used when JiraSeraphAuthenticator is enabled. This is reproducible on Data Center: Yes h3. Steps to...

Atlassian Crowd 3.4.x < 5.1.6 / 5.2.1 RCE (CWD-6139)

The version of Atlassian Crowd installed on the remote host is 3.4.x prior to 5.1.6, or 5.2.x prior to 5.2.1. It is, therefore, affected by a remote execution vulnerability. An authenticated, remote attacker can exploit this, to execute arbitrary code which has high impact to confidentiality, hig...

Request Smuggling org.apache.tomcat:tomcat-catalina Dependency in Crowd Data Center and Server

This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in all versions of Crowd Data Center and Server before 5.0.10, 5.1.8 and 5.2.3. This org.apache.tomcat:tomcat-catalina Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2024-21907

creationtimestamp| type| source ---|---|--- 2024-01-03 17:26:52+00:00| seen| https://t.me/ctinow/162475 2024-01-04 01:36:14+00:00| seen| https://t.me/cibsecurity/74324 2024-01-08 15:12:27+00:00| seen| https://t.me/arpsyndicate/2652 2024-01-23 16:56:42+00:00| seen| https://t.me/ctinow/172119...

Info Disclosure org.apache.santuario:xmlsec Dependency in Crowd Data Center and Server

This High severity org.apache.santuario:xmlsec Dependency vulnerability was introduced in all versions of Crowd Data Center and Server before 5.2.2 This org.apache.santuario:xmlsec Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Vulnerability in Crowd Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 5.2.0, 5.1.5, 5.0.7, 4.4.5, and other older versions of Crowd Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2023-22521

This High severity RCE Remote Code Execution vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality,...

CVE-2023-22521

This High severity RCE Remote Code Execution vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality,...

Remote code execution

This High severity RCE Remote Code Execution vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.0, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality,...

CVE-2023-22521

CVE-2023-22521 concerns Atlassian Crowd Data Center and Server. The vulnerability is an authenticated remote code execution (RCE) affecting the 3.4.6 baseline, with CVSS metrics indicating high impact on confidentiality, integrity, and availability and no user interaction required. Atlassian reco...

Atlassian Crowd Security Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd version 3.4.6 that stems from the...

5 Types of Cyber Crime Groups

Discover the five main types of cyber crime groups: access as a service, ransomware as a service, bulletproof hosting, crowd sourcing, and phishing as a service as well as tips to strengthen your defense strategy...

5 Types of Cyber Crime Groups

Discover the five main types of cyber crime groups: access as a service, ransomware as a service, bulletproof hosting, crowd sourcing, and phishing as a service as well as tips to strengthen your defense strategy...

5 Types of Cyber Crime Groups

Discover the five main types of cyber crime groups: access as a service, ransomware as a service, bulletproof hosting, crowd sourcing, and phishing as a service as well as tips to strengthen your defense strategy...

Atlassian Crowd < 3.6.0 Improper Authorization Via ATST Plugin

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to version 3.6.0. It is, therefore, shipped with a vulnerable version of the Atlassian Troubleshooting and Support plugin ATST, which permitted unprivileged users to initialte log...

Atlassian Crowd < 2.1.0 LDAP Directory Password leakage

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to version 2.1.0. It is, therefore, affected by a LDAP directory password leakage, which permits remote attackers with administration rights to learn the passwords of configured LDAP...

Bump jackson-databind dependency to 2.13.4.2

Embedded Crowd library has transitive dependency to vulnerable library code:java com.fasterxml.jackson.core:jackson-databind:jar:2.12.1 - CVE-2020-36518code It is being included through Crowd dependency to com.microsoft.azure:msal4j:jar:1.11.0 The affected versions are before version 5.0.4...