Design/Logic Flaw

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14....

UBUNTU-CVE-2021-39114

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14....

CVE-2021-39114

CVE-2021-39114 affects Atlassian Confluence Server/Data Center. An OGNL injection in Confluence prior to specific fixed versions allows a valid account on a Data Center instance to execute arbitrary Java code or commands. Affected versions are: before 6.13.23; 6.14.0 before 7.4.11; 7.5.0 before 7...

PT-2022-10885 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server and Data Center versions prior to 6.13.23 Atlassian Confluence Server and Data Center versions 6.14.0 through 7.4.11 Atlassian Confluence Server and Data Center versions 7.5.0 through 7.11.6 Atlassian Confluence...

Atlassian Confluence Server 代码注入漏洞

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi.Atlassian Confluence Data Center is the data center version of Atlassian Confluence. Data Center...

Bitbucket displays sensitive DB details in error message in browser

h3. Issue Summary On application startup, if the database is down the Bitbucket application displays the sensitive database hostname & port details in the error message in browser. Error Message: noformat The database, as currently configured, is not accessible. Connection to : refused. Check tha...

CVE-2021-22795

The CVE-2021-22795 entry affects Schneider Electric StruxureWare Data Center Expert (versions 7.8.1 and earlier) and is an OS Command Injection (CWE-78) vulnerability that could allow remote code execution over the network. Some sources indicate authentication may be required to exploit, while CV...

CVE-2021-22795

A CWE-78 Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CVE-2021-22794

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert V7.8.1 and prior...

CVE-2021-22794

CVE-2021-22794 is a path traversal vulnerability in Schneider Electric’s StruxureWare Data Center Expert (versions 7.8.1 and prior). The issue arises from improper validation of user-supplied input in path handling, enabling remote code execution over the network with no authentication required a...

CVE-2022-26133

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java...

Confluence Data Center - Java Deserialization Vulnerability In Hazelcast - CVE-2016-10750

h3. Vulnerability Details Confluence Data Center uses the third-party software Hazelcast, which is vulnerable to Java deserialization attacks CVE-2016-10750|https://vulners.com/cve/CVE-2016-10750. Hazelcast provides functionality needed to run Confluence Data Center as a cluster. A remote,...

CVE-2022-21820

NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity...

NVIDIA Data Center GPU Manager has an unspecified vulnerability

NVIDIA Data Center GPU Manager is a set of data center management tools from Nvidia that allows you to manage and monitor GPU resources in accelerated data centers.A security vulnerability exists in NVIDIA Data Center GPU Manager due to a bug in nvhostengine. error. An attacker could exploit the...

Bitbucket Data Center - Java Deserialization Vulnerability In Hazelcast - CVE-2022-26133

Update: 2022/04/08 23:00 UTC Coordinated Universal Time, +0 hours Assigned CVE-2022-26133 to this vulnerability, which was determined to be similar to CVE-2016-10750 yet slightly different and specific to Bitbucket Note the new CVE assignment does not change any other information in this advisory...

NVIDIA Data Center GPU Manager 输入验证错误漏洞

NVIDIA Data Center GPU Manager is a set of data center management tools from Nvidia that allows you to manage and monitor GPU resources in accelerated data centers.A security vulnerability exists in NVIDIA Data Center GPU Manager due to a bug in nvhostengine. error. An attacker could exploit the...

DCN Firewall DCME-520 安全漏洞

DCN Firewall DCME-520 is a new generation of high-performance security gateway with multi-core high performance from China Cloud Technology DCN. It has excellent performance and powerful data processing capabilities. A security vulnerability exists in the DCN Firewall DCME-520, which originates...

Security Bulletin: NVIDIA Data Center GPU Manager (DCGM) - March 2022

NVIDIA has released a software update for NVIDIA® Data Center GPU Manager DCGM. The update addresses security issues that may lead to code execution, denial of service, and escalation of privileges. To protect your system, download and install the latest DCGM release from the CUDA repositories. G...

Admin user can change Base URL without WebSudo validation

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to bypass WebSudo validation in order to change the Base URL of a Jira instance via a Broken Access Control vulnerability in the /rest/api/2/settings/baseUrl endpoint. The affected...

A user can view the "createmeta" information of private projects

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers without permission to view a private project to view the project's issue creation meta information via a Broken Access Control vulnerability in the /issue/createmeta endpoint. The affected versions are...