4243 matches found
Atlassian Addresses Issues in Crowd and Bitbucket Products
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Atlassian has two security holes that can be abused to allow arbitrary code execution. CVE-2022-43782 allows an intruder connecting from an IP address on the allow list to authenticate as the crow...
CVE-2022-43781
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...
CVE-2022-43781
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...
Command injection
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...
CVE-2022-43781
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...
CVE-2022-43781
CVE-2022-43781 affects Atlassian Bitbucket Server/Data Center. A vulnerability exists where an attacker who can control their own username can trigger a command-injection by injecting environment variables, enabling remote code execution on the host. The issue is exploitable through the Bitbucket...
CVE-2022-43781
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and...
Atlassian Bitbucket Server和Bitbucket Data Center 命令注入漏洞
Atlassian Bitbucket Server and Atlassian Bitbucket Data Center are both products of Atlassian Australia.Atlassian Bitbucket Server is a Git code hosting solution. The solution manages and reviews code with features such as diff view, JIRA integration, and build integration.Atlassian Bitbucket Dat...
Intel Data Center Manager Elevation of Privilege Vulnerability
Intel Data Center Manager is a software solution from Intel Corporation USA. The Intel Data Center Manager version 5.0 or earlier has an elevation of privilege vulnerability, which stems from a failure in the protection mechanism and can be exploited by attackers to elevate privileges...
Intel Data Center Manager 安全漏洞
Intel Data Center Manager is a software solution from Intel Corporation USA. The Intel Data Center Manager version 5.0 or earlier has an elevation of privilege vulnerability, which stems from a failure in the protection mechanism and can be exploited by attackers to elevate privileges...
Upgrade Apache Commons-text for CVE-2022-42889
h3. BUG RE-OPENED Jira Service Management 5.4.3 which was supposed to be fixed at 9.4.3 / 5.4.3 is still generating files with common text library of 1.6 version in the /plugins/.osgi-plugins folder. Even after deleting these files, they keep generating them back again in the next restart. Due to...
CVE-2022-44724
The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability...
Cross site scripting
The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability...
CVE-2022-44724
CVE-2022-44724 describes a Cross-Site Scripting (XSS) vulnerability in the Handy Tip macro of Stiltsoft Handy Macros for Confluence Server/Data Center, affecting versions 3.x up to 3.5.4. The underlying issue is an XSS in the Handy Tip macro that allows remote attackers to inject arbitrary HTML o...
CVE-2022-41552
Server-Side Request Forgery SSRF vulnerability in Hitachi Infrastructure Analytics Advisor on Linux Data Center Analytics, Analytics probe components, Hitachi Ops Center Analyzer on Linux Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe components allows Server Side...
Putting a word in quotes and having the > character in the summary allows scripts to execute
h3. Issue Summary If you have a summary with a word in double quotes, similar to "Something" and have the character. Then you can execute actions through tags in the summary This is reproducible on Data Center: Yes h3. Steps to Reproduce This can be reproduced when editing and creating an issue...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2022-26134 - OGNL injection vulnerability. Script proof...
Attachments that are added to drafts while collaborative editing is off are searchable when collaborative editing is turned on
h3. Issue Summary This is reproducible on Data Center: yes h3. Steps to Reproduce Turn OFF collaborative editing Create a page Add attachment to the page Do not publish the page Try searching for the draft or attachment Enable Collaborative Editing Perform Reindexing Try searching for the draft o...
Vulnerable version of xmlsec used - CVE-2021-40690 in atlassian-authentication-plugin
Recently we have identified that on top of the libraries mentioned in JRASERVER-73580, there was another libraryatlassian-authentication-plugin that has a transitive dependency of xmlsec that could be related to the vulnerability described in...