Atlassian Jira < 7.6.0 Xss In SearchRequest.xml Resource

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.6.0. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through...

Atlassian Jira 7.13.0 < 8.3.0 Xss Via Project Configuration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.3.0. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the...

Atlassian Jira < 8.5.4 Dos Through Gadget API

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make Jira unresponsive via repeated requests to a certai...

Atlassian Jira 8.0.0 < 8.5.0 Csrf On Wallboard Endpoint

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.0. It is, therefore, affected by a vulnerability which permits remote attackers to modify Wallboard settings via a Cross-site request forgery CSRF vulnerability. Note that...

Atlassian Jira < 5.0.1 Arbitrary File Reads

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 5.0.1. It does, therefore, not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of servic...

Atlassian Confluence 7.13.9 < 7.13.12 Embedded Spring-Beans Denial Of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.9 prior to 7.13.12, 7.19.0 prior to 7.19.3. It is, therefore, affected by a Denial of Service DoS attack vulnerability when relying on attacker controlled data binding to set a...

Atlassian Jira < 8.9.0 Improper Authorization In Project Administration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.9.0. It is, therefore, affected by a vulnerability which permits remote attackers to obtain information about custom project avatars via an improper authorization...

Nginx Missing Root Location

The scanner has detected that the Nginx installation does not have a directive for the root location '/'. This could potentially leak useful information about the server installation to a remote, unauthenticated attacker. No source data...

Atlassian Jira 8.6.x < 8.8.2 WYSIWYG Editor Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9 or 8.6.x prior to 8.8.2. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting X...

Nginx Cloud Storage HTTP Splitting

The scanner has detected that the Nginx configuration has a directive location specified to query a cloud storage instance. However, it is possible to insert an arbitrary payload containing a line break, which allows a malicious attacker to change the cloud storage instance to be queried. It is...

Atlassian Jira Service Desk 4.7.1 < 4.10.0 Cross-Site Scripting In API and Integrations

According to its self-reported version number, the Atlassian Jira Service Desk application running on the remote host is version 4.7.x prior to 4.10.0. It is, therefore, affected by a flaw which may permit a remote attacker to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS...

Atlassian Confluence 6.4.3 < 6.6.1 Resource Attachment Content Spoofing

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.6.1. It may, therefore, permit remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of...

Server-Side Inclusion Injection

A Server-Side Include Injection vulnerability exists when an application embeds and evaluates unsafe user-controlled server-side include directives. By injecting a specific payload an attacker can leverage this vulnerability to conduct a remote code execution. No source data...

SUSE CVE-2007-2589

Cross-site request forgery CSRF vulnerability in compose.php in SquirrelMail 1.4.0 through 1.4.9a allows remote attackers to send e-mails from arbitrary users via certain data in the SRC attribute of an IMG element...

Form With Password Detected

This is an informational notice that the scanner identified a potential form with a password. No source data...

AppVeyor Configuration Detected

AppVeyor is a continuous integration and deployment service available as a Software as a Service SaaS based application or as a private instance and which is used to build and test software projects. By defining a configuration file named appveyor.yml in their source code repositories, developers...

Rails Development Mode Enabled

The Ruby on Rails RoR web framework uses three environments by default : test, development and production. When running in development mode, the application will render diagnostic pages and expose all the routes available, leaking internal information about the application. In some cases, the...

SQL Statement Disclosure

Web applications usually rely on backend database servers to store persistent information like users, sessions or for example products of an e-commerce website. In some cases, these web applications may fail to properly handle potential errors raised when querying the database, displaying raw...

Password Reset Form Detected

This is an informational notice that the scanner identified a potential password change form. No source data...

Password Submitted Using GET Method

The scanner was able to detect that the application uses the HTTP GET method to transmit a password, the information of a URL can be stored in various places web server, proxy, ... and can be transmitted to a third party via the Referer header which also increases the chances of interception by a...