Atlassian Jira Authenticated Upload Code Execution Exploit

This Metasploit module can be used to execute a payload on Atlassian Jira via the Universal Plugin ManagerUPM. The module requires valid login credentials to an account that has access to the plugin manager. The payload is uploaded as a JAR archive containing a servlet using a POST request agains...

Cross-Site Scripting (XSS)

Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user's browser. This allows a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

org.eclipse.jetty.aggregate:jetty-all (7.6.20.v20160902), org.eclipse.jetty.aggregate:jetty-all-server (7.6.20.v20160902) +36 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.20.v20160902)

org.eclipse.jetty:jetty-server MAVEN version 7.6.20.v20160902 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.6.20.v20160902 -...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc2) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.5.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

com.hazelcast:hazelcast-jetty7-sessionmanager (>=1.0, <=1.0.2), org.akhikhl.gretty:gretty-runner-jetty7 (>=1.1.9, <=2.0.0) +52 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.6.16.v20140903)

org.eclipse.jetty:jetty-server MAVEN version 7.6.16.v20140903 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hazelcast:hazelcast-jetty7-sessionmanager =1.0, =1.1.9, =1.4.10, =1.4.14 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc5), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc5) +43 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (8.1.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc5 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.1.0.rc1) +33 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2015-2080 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

HTTP security headers are not present for app's servlet but are sent on regular Confluence page

h3. Summary When creating a servlet in a plugin/app, and accessing the servlet in the browser, you notice that security headers are not included: !Screenshot 2018-11-06 at 15.34.38.png|thumbnail! Unlike when accessing a Confluence Page: !Screenshot 2018-11-06 at 15.34.15.png|thumbnail! Notice the...

Apache Tomcat 8.5.16 < 8.5.24 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.24. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 9.0.0.M22 < 9.0.2 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.2. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 8.5.x < 8.5.15 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

Apache Tomcat 7.0.79 < 7.0.84 Insecure CGI Servlet Search Algorithm Description Weakness

The version of Apache Tomcat installed on the remote host is 7.0.x prior to 7.0.84. It is, therefore, affected by a flaw that is due to the program containing an incorrect description for the CGI Servlet search algorithm, which may cause an administrator to leave the system in an insecure state...

Apache Tomcat 7.0.x < 7.0.78 Remote Error Page Manipulation

According to its self-reported version number, the Apache Tomcat service running on the remote host is 7.0.x prior to 7.0.78 or 8.5.x prior to 8.5.15. It is, therefore, affected by an implementation flaw in the error page reporting mechanism in which it does not conform to the Java Servlet...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc0) +22 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-examples-java (1.0.0rc0), org.cometd.java:cometd-java-oort (1.0.0rc0) +33 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.0.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-examples-java 1.0.0rc0 - org.cometd.java:cometd-java-oort 1.0.0rc0 -...