Lucene search
+L
AtlassianMost viewed

4567 matches found

Atlassian
Atlassian
added 2010/04/22 4:27 a.m.30 views

Path for daily backup is configurable through WEB UI

It is possible to set the daily backup path and partial name through the web UI. This could mean that information can be obtained by a rouge admin. This issue addresses that by introducing a flag so concerned administrators can remove this feature. This flag is set to false by default meaning it ...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2010/04/22 12:36 a.m.30 views

XSS Bookmark vulnerabilities

The Add bookmark page is vulnerable to XSS attacks...

1.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2010/04/18 1:44 a.m.30 views

The current CAPTCHA implementation may not be secure

The current CAPTCHA implementation displays a different message if the CAPTCHA is being displayed and the captcha is entered correctly but the password for the user is not, than if the CAPTCHA is entered incorrectly. This is giving away more information than a login screen should. The error messa...

0.5AI score
SaveExploits0
Atlassian
Atlassian
added 2010/04/08 8:10 p.m.30 views

Signing in with username with different case creates new user

We currently utilize LDAP for our user repository and allow users to be automatically added to crucible if they can successfully authenticate. We have recently received complaints from users that their names were showing up two times in reviews. After some analysis we saw that there were 2...

7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2010/01/20 6:41 p.m.30 views

autocomplete box in page restrictions finds deleted users, wrong usernames

We recently migrated our user management from JIRA to Crowd, our Confluence instance used to link to JIRA for authentication, and now links to Crowd. We now found that, when editing the restrictions on individual pages, the autocomplete feature in that dialog acts strange: Users that have been...

0.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/10/12 9:20 p.m.30 views

Workflow permission to limit ability to link issues

We need to be able to limit the ability to link issues by the issue status. If we have two issues, and they are both closed, I do not want to be able to link them. If one or both are opened or in progress, I'd like to be able to create the link from the open issue. We are trying to use Jira for...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/10/09 1:02 a.m.30 views

Links from indexbrowser.jsp are vulnerable to XSS attacks

CONF-16888 has introduced or re-introduced an XSS vulnerability. To reproduce: Create a new user, and for the Full Name use: noformatalert'Vulnerable'noformat Go to ../admin/indexbrowser.jsp and find the entry Click on the entry, and the script is executed. This also happens for other content typ...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/07/01 2:36 a.m.30 views

Allow Site Admin to discover restricted pages

A customer mentioned that this functionality is important to have for automation and integration purposes. Currently confluence-administrators are not able to discover restricted pages, despite of their ability to access ie. read the page if they know the url. The customer argued that "this makes...

3.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/06/18 1:45 p.m.30 views

Directory traversal in Profile Picture path - leads to privilege escalation in < 3.0

Confluence allows its users to specify a "Profile Picture," an image that appears on many pages related to the user. A user can either upload a custom image, or select one from a set provided by Confluence. Confluence uses the /users/doeditmyprofilepicture.action path to process requests to chang...

7.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/06/18 6:38 a.m.30 views

XSS vulnerability in space name when page move would create a duplicate

Create a space called alert"XSS"; Find a page named 'Home' in a different space Move this page, choosing the previously created space as the destination The move will fail due to the duplicate page name, and the script will be run...

1.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/05/20 6:05 p.m.30 views

CSRF attack message thrown when JSESSIONID is changed

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-15779. panel Symptoms: Anything that is using DWR will fail. Meaning: page editor is fully or partially unusable and it may...

SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/05/07 2:13 a.m.30 views

The i18n in velocity templates does not auto html encode parameters

All the getText methods on com.atlassian.confluence.util.i18n.DefaultI18NBean are anontated as HtmlSafe which means that any parameter which gets passed in as an argument will not be auto html encoded by the Anti-XSS module. The most straight forward way to fix this is to wrap the parameter insid...

0.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/04/21 1:39 p.m.30 views

Issue attachments, need a functionality of Security Schemes

In our JIRA instance both customers and developers have access to issues. We would like to have a security scheme functionality in connection to issue's attachments. In other words, we would like to attach a documentation which would not be visible to customers or other groups of JIRA users...

1.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/04/09 1:34 a.m.30 views

Update JIRA certificate for Screenshot Applet and others. It expires in June 2009

See https://extranet.atlassian.com/jira/browse/ADM-3253 Move Steves branch into trunk in the process. Also I think the build environment might need direct updating...

1.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/03/19 4:23 p.m.30 views

Reporting Plugin- Cross-site scripting error

Our e-security found the following error for the Reporting plugin: Number System/Location Defect Type Status R2 Reporting Plugin Client-side Attacks: Cross-site Scripting Open Description Security Risk: It is possible to steal or manipulate customer session and cookies, which may be used to...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2009/02/04 6:44 a.m.30 views

Fix header injection vulnerabilities

A number of vulnerabilities were found during JRA-16024 which expose JIRA to header injection attacks: Note that different application server configurations may expose or hide the presence of a header injection vulnerability. Standalone tomcat is usually not vulnerable. Tomcat 5.5.26 redirects al...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2008/12/17 4:34 a.m.30 views

Word import with Office Connector can overwrite existing content without permission

It's possible under a specific set of circumstances that a user could perform actions they may otherwise be unauthorized to perform using the document import feature of the Office Connector. The specific actions would be editing or deleting a page they don't have permission to change. Note that...

2.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2008/12/17 4:34 a.m.30 views

Word import with Office Connector can overwrite existing content without permission

It's possible under a specific set of circumstances that a user could perform actions they may otherwise be unauthorized to perform using the document import feature of the Office Connector. The specific actions would be editing or deleting a page they don't have permission to change. Note that...

2.4AI score
SaveExploits0
Atlassian
Atlassian
added 2008/09/15 4:25 p.m.30 views

XSS in RSS feed creation

URL http://localhost:8080/dashboard/doconfigurerssfeed.action The RSS feed creation process is vulnerable to XSS attacks. It is possible to inject javascript code into the page by changing the types field to: types="alertdocument.cookie complete example from the testenvironment:...

6.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2008/09/08 8:18 a.m.30 views

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

0.8AI score
SaveExploits0
Atlassian
Atlassian
added 2008/03/13 1:29 p.m.30 views

Watchers can see comments that they are not supposed to see via email notifications

We have email notifications switched on for our live version of JIRA. If you watch an issue then you receive an email each time somebody comments on that issue. This email contains information about the issue including the comment that was added. This is great as it allows people to keep up to da...

1.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2007/10/09 3:24 p.m.30 views

user value of JiraAuthenticationContext not set is SOAP service getIssue()

Call to JiraAuthenticationContext.setUser missing during getIssue SOAP service call. Service call will fail silently if there are custom fields with explicit secutity checking for attributes derived from current user. In my case I try to verify existance of an issue using getIssue SOAP service...

1.6AI score
SaveExploits0
Atlassian
Atlassian
added 2007/10/03 2:58 a.m.30 views

Velocity does not automatically escape HTML entities when substituting variables

Velocity should automatically escape encode HTML entities in variables it interpolates in markup. This would remove the need for explicitly escaping variables using $generalUtil.htmlEncode, and fix lots of XSS bugs including ones we haven't discovered yet. This affects all versions of Confluence...

2.2AI score
SaveExploits0
Atlassian
Atlassian
added 2007/07/30 6:32 p.m.30 views

"Current Assignee" on Browse Permission problem

I have created a permission scheme in Jira but I am experiencing an odd behaviour. I have 5 users in Jira and in the permission scheme, the Browse Projects is assigned to: - Project Lead - Project Role Administrators - Project Role Clients Among the 5 users, 3 fit these categories. One is a proje...

2.6AI score
SaveExploits0
Atlassian
Atlassian
added 2007/07/24 7:51 a.m.30 views

Reflected XSS Vulnerability in the Feed Builder

---- Input in the Feed Builder is not properly handled. Insert: code "alert'Gotcha!' code as the feed name title and you get url like this:...

0.5AI score
SaveExploits0
Atlassian
Atlassian
added 2007/06/14 8:55 a.m.30 views

CommentService validation methods do not check user's security level

The validateCommentUpdate, hasPermissionToUpdate and hasPermissionToDelete methods on DefaultCommentService check the user's comment-related permissions but neglect to check whether they have a role/group security level viewable by the user attempting to delete a comment...

2.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2007/04/26 3:14 p.m.30 views

Allow embedding multimedia content located on remote servers

Re: CSP-8387 Currently, when embedding multimedia content on Confluence you are restricted to embedding files located on the Confluence server. The page http://confluence.atlassian.com/display/CONF20/Embedding+Multimedia+Content singles out "security reasons" as the reason for this limitation. In...

2.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2007/03/07 9:02 p.m.30 views

Project Role Modifications not reflected in Issue Security Scheme

If you modify users/groups in a project's project role and this project uses an issue security scheme, you must remove the role and re-add it to the issue security scheme for the role changes to take effect. Steps to Reproduce: 1. Need to be the admin of a project whose issue creation screen has...

0.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2005/11/03 3:17 a.m.30 views

Project admin is presented with an option to select a Screen Scheme

The option of changing the scheme should only be given to the global admins...

1.4AI score
SaveExploits0
Atlassian
Atlassian
added 2005/09/14 4:22 a.m.30 views

A user cannot set the security level to none if the default security level is set

Selecting 'none' always creates an issue with the default security level...

1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2004/09/17 9:37 a.m.30 views

MoveIssue does not keep the security issue level after the move.

MoveIssue does not keep the security issue level after the move...

1.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2004/06/29 10:11 p.m.30 views

Spam-protection

We need something like MT-Blacklist: the ability to define URL patterns that flag a page and/or comment as spam. It shouldn't be too hard to do - we already track URL links. The UI will need some thought though what do you do if you define a URL as spam, and it's in a page? Revert the page back t...

0.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2002/07/09 10:11 p.m.30 views

Login errors in 1.3

When logging in as our special user who is restricted to one certain project, I get this error message from secure/Dashboard.jspa java.lang.IllegalArgumentException: Source may not be null at webwork.util.SubsetIteratorFilter.setSourceSubsetIteratorFilter.java:33 at...

2.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2002/04/09 2:39 p.m.30 views

Asked to re-authenticate to delete issue

/jira/secure/DeleteIssue!default.jspa?id=10012 everything seems to work ok, but I try to delete previously existing issue and I get redirected to the URL above. instead of a delete issue page, I get a login page, only it looks messed up - it's the login form table miniwindow except spread 100%...

0.6AI score
SaveExploits0
Atlassian
Atlassian
added 2026/06/11 5:30 p.m.29 views

SSRF (Server-Side Request Forgery) axios Dependency in Bamboo Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of...

8.6CVSS5.3AI score0.0087EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/05/06 4:29 p.m.29 views

File Inclusion in Jira Service Management Data Center

This High severity File Inclusion vulnerability was introduced in versions 5.15.2, 5.16.1, 5.17.0, 10.0.0, 10.1.2, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This File Inclusion vulnerability, with a CVSS Score of 7.1...

7.1CVSS6.8AI score0.00288EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/05/05 4:29 p.m.29 views

DoS (Denial of Service) in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 5.17.2, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.1, 10.6.0, 10.7.2, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 a...

7.5CVSS6.9AI score0.02688EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/04/20 2:22 a.m.29 views

DoS (Denial of Service) net.minidev:json-smart Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticat...

7.5CVSS6.6AI score0.01119EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/04/16 1:22 p.m.29 views

MITM (Man-in-the-Middle) com.squareup.okhttp3:okhttp Dependency in Jira Service Management Data Center and Server

This High severity MITM Man-in-the-Middle vulnerability was introduced in version 10.3.0 of Jira Service Management Data Center and Server. This vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of code:java CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Ncode allows an unauthenticated attack...

7.5CVSS6.9AI score0.00877EPSS
SaveExploits0
Atlassian
Atlassian
added 2026/04/16 1:05 p.m.29 views

Improper Authorization commons-beanutils:commons-beanutils Dependency in Jira Service Management Data Center

This High severity Improper Authorization vulnerability was introduced in versions 5.12.1, 5.15.2, 5.16.0, 5.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, and 10.7.1 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.8 and a...

8.8CVSS7.5AI score0.01825EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/04/11 10:29 a.m.29 views

File Inclusion node-tar Dependency in Confluence Data Center

This High severity File Inclusion vulnerability was introduced in versions 8.9.0, 9.0.1, 9.0.3, 9.1.0, 9.2.5, 9.2.20, 9.5.1, 10.1.2, 10.2.0 and 10.2.11 of Confluence Data Center. This File Inclusion vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of...

8.2CVSS6.6AI score0.00253EPSS
SaveExploits6
Atlassian
Atlassian
added 2026/04/08 10:29 p.m.29 views

MITM (Man-in-the-Middle) xmlhttprequest Dependency in Jira Service Management Data Center

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity MITM Man-in-the-Middle vulnerability was introduced in versions 11.1.0, 11.2.0, and 11.3.0 of Jira Service...

9.4CVSS7.2AI score0.02056EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/04/08 4:29 a.m.29 views

DoS (Denial of Service) css Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.2.3, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.2, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

7.5CVSS5.7AI score0.01121EPSS
SaveExploits0
Atlassian
Atlassian
added 2026/04/08 4:29 a.m.29 views

DOM-based XSS @remix-run/router Dependency in Confluence Data Center

This High severity DOM-based XSS vulnerability was introduced in versions 9.0.1, 9.0.3, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This DOM-based XSS vulnerability, with a CVSS Score of 8 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A...

8CVSS7.6AI score0.00801EPSS
SaveExploits0
Atlassian
Atlassian
added 2026/04/08 4:29 a.m.29 views

Injection immutable Dependency in Confluence Data Center

This High severity Injection vulnerability was introduced in versions 9.0.1, 9.0.3, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Injection vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

9.8CVSS5.7AI score0.00978EPSS
SaveExploits1
Atlassian
Atlassian
added 2026/01/08 11:27 p.m.29 views

DoS (Denial of Service) ansi-regex Dependency in Jira Software Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in version 9.15.2, 9.16.0, 9.17.0, 10.1.1, 10.3.13, 11.2.0 of Jira Software Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of code:java...

7.8CVSS8.1AI score0.03552EPSS
SaveExploits1
Atlassian
Atlassian
added 2025/12/18 9:27 p.m.29 views

XXE (XML External Entity Injection) org.apache.tika:tika-core Dependency in Confluence Data Center and Server

This High severity XXE XML External Entity Injection vulnerability was introduced in versions 7.7.0 of Confluence Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 8.4 and a CVSS Vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H allows an...

9.8CVSS5.6AI score0.15038EPSS
SaveExploits4
Atlassian
Atlassian
added 2025/12/18 7:28 a.m.29 views

XXE (XML External Entity Injection) in Confluence Data Center and Server

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity XXE XML External Entity Injection vulnerability was introduced in versions 9.2.8 and 10.2.0 of Confluence Data Center a...

9.8CVSS5.7AI score0.80336EPSS
SaveExploits6
Atlassian
Atlassian
added 2025/12/10 7:29 a.m.29 views

RCE (Remote Code Execution) in Jira Software Data Center and Server

This High severity RCE Remote Code Execution vulnerability was introduced in version 11.2.0 of Jira Software Data Center and Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows an unauthenticated...

7.5CVSS8.6AI score0.21261EPSS
SaveExploits0
Atlassian
Atlassian
added 2025/09/26 7:31 a.m.29 views

Path Traversal (Arbitrary Write) in Jira Software Data Center and Server

This High severity Path Traversal Arbitrary Write vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal Arbitrary Write vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem...

6.8AI score
SaveExploits0
Total number of security vulnerabilities4567