CVE-2026-63630 BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf sends an...

CVE-2026-45412 MaxKB: Unauthenticated SSRF via Workflow Template Import

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via workflowtemplate Import. Authenticated users can supply arbitrary URLs in workflowtemplate.downloadUrl which are fetched server-side without any URL validation or internal IP filtering. This vulnerability is fixed in...

Atlassian Jira 7.2.0 < 8.18.1 Remote Code Execution In Workflow Import

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.19.0. It is, therefore, affected by a vulnerability which allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrar...

Atlassian Jira 7.2.x < 8.18.1 / 8.19.0 (JRASERVER-72660)

The version of Atlassian Jira installed on the remote host is prior to 7.2.x 8.18.1 / 8.19.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72660 advisory. - Remote code execution in workflow import - CVE-2017-18113 CVE-2017-18113 Note that Nessus has not tested for...

CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability. The vulnerability allowed for...

Remote code execution in workflow import - CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability which allowed for various...

Remote code execution in workflow import - CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability which allowed for various...

PT-2021-8571 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Jira Server and Jira Data Center versions prior to 8.18.1 Description: The issue allows remote attackers to execute arbitrary code via a Remote Code Execution RCE vulnerability, by tricking a system administrator into importing a malicious...