Lucene search
+L
AtlassianMost viewed

4730 matches found

Atlassian
Atlassian
•added 2012/09/27 4:29 p.m.•30 views

Accidental XSRF and DoS consumption-of-space issue

We experienced an unusual growth of our nonspaced attachments that appears to be a DoS vunerability both in an accidental way with a workaround and intentional not easily worked around. This is under Confluence 4.0, but appears to probably apply to 4.3.1 as well. It appears the growing nonspaced...

0.7AI score
SaveExploits0
Atlassian
Atlassian
•added 2012/09/12 3:55 a.m.•30 views

Reflected XSS within the username parameter of the /user/non-system/{username} rest resource

The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...

0.4AI score
SaveExploits0
Atlassian
Atlassian
•added 2012/09/12 3:55 a.m.•30 views

Reflected XSS within the username parameter of the /user/non-system/{username} rest resource

The confluence-rest-plugin has a rest resource to look up "non-system" users which takes in a username. If given username supplied is not found then it is included in an xml error message without being xml encoded and thus is a XSS vector. That is, and other such xml special characters are not...

0.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/09/10 12:19 p.m.•30 views

Information disclosure in REST API

REST endpoints to search groups and to list issue resolutions allow anonymous/unauthenticated access. The former allows to enumerate all groups on a JIRA instance by sending multiple queries as results are limited by jira.ajax.autocomplete.limit. We've verified this on an instance without any...

0.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/09/03 2:04 a.m.•30 views

Session expiry pages may echo password in clear text

The "session expiry" and "XSRF token missing" pages will echo any submitted values. This may result in echoing the submitted password to the page in plain text if triggered on the WebSudo authentication page. Modify the error pages sessionexpired.jsp and xsrfmissing.jsp so they don't echo...

0.4AI score
SaveExploits0
Atlassian
Atlassian
•added 2012/08/29 11:13 a.m.•30 views

Inherit Edit Restrictions for Child Pages

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-26446. panel As it said in Documentation for Page Restrictions|https://confluence.atlassian.com/display/DOC/Page+Restrictions:...

1.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/08/20 6:19 a.m.•30 views

GH Webwork actions are vulnerable to XSRF.

GHCreateNewIssue.jspa is not protected against XSRF attacks. Impact: It is possible for an attacker to make a victim create new issues on the victim's JIRA instance through this bug in GHCreateNewIssue.jspa...

3.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/08/16 2:13 p.m.•30 views

There is a reflected xss flaw in the settings.action of dailysummary settings.action.

There is a reflected xss flaw in the settings.action of dailysummary settings.action as the username parameter is not html encoded before being rendered on the page. Here is an example of a reflected xss it adds a picture of a lolcat to the page...

0.4AI score
SaveExploits0
Atlassian
Atlassian
•added 2012/05/07 7:00 a.m.•30 views

Javascript escape the value of "dark features" within the javascript context they are rendered out in

Current user specific dark feature values are not javascript escaped in the javascript context they exist in. e.g. the value "' + evalalert1 ' +" without the double quotes appears like the following in the feature javascript context: / Dark features are features that can enabled and disabled per...

1.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/05/07 6:55 a.m.•30 views

The "user" Dark Features page is vulnerable to XSRF/csrf

The "User Dark Features" page located at $host/secure/ViewProfile.jspa?selectedTab=jira.user.profile.panels:up-darkfeatures-panel allows users to add dark features which only affect themselves. However, it is not protected against XSRF attacks. Note: the 'value' of dark features is not properly...

1.3AI score
SaveExploits0
Atlassian
Atlassian
•added 2012/05/06 11:36 p.m.•30 views

OauthApplinksServlet Open Redirect

The OauthApplinksServlet servlet has an open redirect vulnerability in the doGet that will allow phishers to lure users away from legitimate JIRA hosted sites. An open redirect vulnerability is caused by an attacker having control over a request parameter that hasn’t been validated before redirec...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/05/06 11:31 p.m.•30 views

AddConsumerReciprocalServlet Open Redirect

The AddConsumerReciprocalServlet servlet has an open redirect vulnerability in the doGet method that will allow phishers to lure users away from legitimate JIRA hosted sites. An open redirect vulnerability is caused by an attacker having control over a request parameter that hasn’t been validated...

SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/04/19 1:14 a.m.•30 views

admin/fixCaseInSpacePermissions.jsp lacks an XSRF token to 'fix the case of your space permissions'

admin/fixCaseInSpacePermissions.jsp does not require a csrf token to 'fix the case of your space permissions'. When fixing this issue, please ensure that the JSP is converted to an action or deleted - we don't want to have to maintain our XSRF infrastructure in JSPs...

1.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/04/04 6:36 a.m.•30 views

/secure/admin/jira/AcknowledgeTask.jspa is an open redirect

The AcknowledgeTask.jspa page found under http://$HOST/secure/admin/jira/AcknowledgeTask.jspa can be used to redirect users to another page on the internet and possibly used to create a non-persistent xss flaw. Here is an example url which will direct a user to http://google.com...

7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/01/08 11:39 p.m.•30 views

Provide an abstract Seraph authenticator for SSO authenticators to subclass that reduces the plumbing code required to interact with Embedded Crowd

This is currently the most comprehensive version I have so far compiled of the code a custom SSO authenticator for Seraph must provide in order to not break any of the functionality in Confluence: https://bitbucket.org/jaysee00/example-confluence-sso-authenticator. It would be great if we could...

1.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2012/01/08 11:39 p.m.•30 views

Provide an abstract Seraph authenticator for SSO authenticators to subclass that reduces the plumbing code required to interact with Embedded Crowd

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-24358. panel This is currently the most comprehensive version I have so far compiled of the code a custom SSO authenticator for...

0.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/12/01 1:07 p.m.•30 views

Activity Streams shows restricted content from Confluence

To reproduce: Create a test user Configure the user to only belong to the 'users' group Remove 'users' group from Confluence global permission, hence, 'users' group won't be able to use Confluence In the activity streams gadget in default JIRA dashboard, test user can still see Confluence...

0.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/10/28 6:22 p.m.•30 views

Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/09/05 11:26 p.m.•30 views

XSS Vulnerability in Administration Interface of JIRA Bamboo Plugin

We have identified and fixed a cross-site scripting XSS vulnerability in JIRA administration interface. Affected version is JIRA 4.3.x XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a JIRA page. You can read more about XSS attacks at various places on the web...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/09/05 3:18 p.m.•30 views

Inline attachment downloads vulnerable to XSS by setting tweaked HTML content type

Please see CONFDEV-9069 https://jira.atlassian.com/browse/CONFDEV-9069 for the current issue addressed at fixing attachment XSS vulnerabilities. --- TLDR: white-list mime-types which can be served "inline" and don't let the user set arbitrary mime-types. I have been having a good laugh sorry...

6.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/07/01 10:40 a.m.•30 views

Web Sudo should be able to be subverted for non browsers (eg scripts) via a HTTP header

We do this for XSRF protection. Basically you should be able to subvert the web sudo mechanism via a HTTP header. This posts shows the use case https://answers.atlassian.com/questions/1273/jira-jelly-runner-via-cron-in-v4-3-4 I believe it just as secure since web sudo is really design to stop som...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/06/27 11:56 p.m.•30 views

logout.action is not protected against XSRF

This is a duplicate of CONF-21758. Please only resolve this ticket when CONF-21758 is fixed...

1.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/06/14 5:27 a.m.•30 views

Admin JSPs don't have XSRF protection

As well as a number of XSS bugs which were recently fixed in CONF-22568, the JSPs contained in Confluence don't support the same XSRF protection which our actions use. We should convert this functionality over to actions and only use JSPs to deliver patches to customers, not for proper...

2.4AI score
SaveExploits0
Atlassian
Atlassian
•added 2011/06/10 5:28 p.m.•30 views

Make captcha harder, or allow configuration of captcha difficulty, in order to prevent sophisticated spam attacks

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-22700. panel Every day we get a load of automated anonymous comment spam on our confluence pages. It seems that the captcha is t...

1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/05/23 1:48 a.m.•30 views

Members of confluence-administrators receive notifications for comments and attachments on restricted pages

Members of the special confluence-administrators group have access to all content on the site, however they should not see restricted content in search results or get notifications about changes on restricted pages. There is a bug in the permission check for notifications about "contained" object...

3.2AI score
SaveExploits0
Atlassian
Atlassian
•added 2011/05/11 7:03 a.m.•30 views

XSS vulnerability in doeditmysettings.action

This vulnerability affects all versions from 3.5 and above. We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence settings editing action. XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a Confluence page. You can read more...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/04/26 9:08 a.m.•30 views

"Forgot Password" feature should not reveal that a given username exists within Confluence for security reason

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-22388. panel It is possible to see which user exists on Confluence or not from within "Forgot Password" link. This is bad for...

1.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2011/03/23 5:32 a.m.•30 views

Searching within restricted pages/spaces

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-22074. panel This is the issue reference:...

7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/10/12 1:07 a.m.•30 views

Patches for XSS / XSRF vulnerabilities

We have identified and fixed vulnerabilities in JIRA 4.2 which will allow an attacker to invoke XSS Cross Site Scripting attacks and/or Cross Site Request Forgery XSRF attacks. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory...

1.6AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/10/05 12:52 a.m.•30 views

Confluence features that require password confirmation (websudo, captcha) do not work with custom authentication

When user is required to confirm the password, Confluence always checks the entered password against the internally stored user/password. If an instance is configured to use custom authentication which is different from atlassian-user, the password validation will fail. h3. Resolution This is fix...

0.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/09/27 5:20 p.m.•30 views

Non-secure content warning in IE8 on the Dashboards screen caused by the wiki renderer

Wiki renderer-generated contents e.g. in the activity stream include references to icons with http prefix that cause IE8 to generate security warnings for JIRA instances accessible via HTTPS. To reproduce it, have contents in the activity stream gadget contain icons included by the wiki renderer,...

1.1AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/09/03 3:14 a.m.•30 views

Allow anonymous/public access at page level

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-20737. panel Although a space might be restricted to some groups/users, it is sometimes required to allow public/anonymous acce...

1.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/08/18 6:38 a.m.•30 views

websudo annotation backwards compatibility (Confluence 3.3)

Following this guide|http://confluence.atlassian.com/pages/viewpage.action?pageId=219021702, I started to use the websudo annotations to secure an XWork action that would process a form in the space admin tab. The plugin is meant to work with Confluence 3.3 and I haven't released a public version...

1.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/08/02 5:14 a.m.•30 views

Secure Administrator Sessions feature can be bypassed

In some circumstances an attacker may be able to craft a request to a Confluence server that bypasses the additional layer of security added by the new Secure Administrator Sessions feature introduced in Confluence 3.3. This would allow an attacker to perform administrative functions on Confluenc...

0.6AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/08/02 5:14 a.m.•30 views

Secure Administrator Sessions feature can be bypassed

In some circumstances an attacker may be able to craft a request to a Confluence server that bypasses the additional layer of security added by the new Secure Administrator Sessions feature introduced in Confluence 3.3. This would allow an attacker to perform administrative functions on Confluenc...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/07/28 4:42 p.m.•30 views

NullPointerException when there are no cookies and AccessLogRequestInfo is enabled

When using the filter-list and project-list plugins I ran into an issue where NullPointerExceptions were being thrown. I turned out the issue is in AccessLogRequestInfo when the Cookie header doesn't exists. The line that causes the exception is a log.debug line. I am including a patch that check...

1.2AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/06/21 3:40 a.m.•30 views

XSS vulnerability in PDF export

We have identified and fixed a cross-site scripting XSS vulnerability in the Confluence action that performs the export to PDF. An attacker might take advantage of the vulnerability to steal other users' session cookies or other credentials, by sending the credentials back to such an attacker's o...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/22 1:03 a.m.•30 views

Not all error strings are encoded

A XSS vulnerability where a string could bypass the Anti-XSS mechanism has been identified. This issue corrects this problem. The severity of this issue is rated as LOW. Please see http://confluence.atlassian.com/x/ZILmD for information on other security related issues and our rating system...

0.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/22 12:59 a.m.•30 views

Possible XSS injection in attachment upload

A XSS vulnerability has been identified in attachment upload. The severity of this issue has been rated HIGH. Please refer to the security advisory at http://confluence.atlassian.com/x/ZILmD for information on how we rate issues...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/22 12:58 a.m.•30 views

JIRA is vulnerable to clickjacking attacks

A clickjacking attack on JIRA would most likely take the form of a third-party site, containing an invisible iframe on top of an unrelated page. The iframe would contain a page in JIRA. The victim would believe he was clicking on the other site but would actually be clicking in JIRA and performin...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/22 12:36 a.m.•30 views

XSS Bookmark vulnerabilities

The Add bookmark page is vulnerable to XSS attacks...

1.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/19 2:59 a.m.•30 views

Group picker popup JSP has XSS hole if group names are XSS shaped

If a group name has a XSS shaped name, then the group picker will allow scripts to be executed...

1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/19 2:59 a.m.•30 views

Group picker popup JSP has XSS hole if group names are XSS shaped

If a group name has a XSS shaped name, then the group picker will allow scripts to be executed...

1AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/04/16 5:06 a.m.•30 views

screenshot-redirecter.jsp XSS attach via the afterURL parameter

The screenshot-redirector.jsp does note escape the 'afterURL' URL parameter correctly, leading to an XSS attack vector...

3.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/16 4:29 a.m.•30 views

Announcement Preview banner is a vector for an XSS attack

The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcementpreviewbannerst URL parameter. We should display the preview only locally in the admin section...

2.7AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/04/13 5:50 a.m.•30 views

Privilege escalation vulnerability when administrator access is compromised

panel:borderColor=ff0000|borderStyle=solid|bgColor=ffccccNote: This issue is superceded by JRA-21004. Please install the patches on that issue, rather than this one. For more details, see JIRA Security Advisory -...

0.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/04/13 5:50 a.m.•30 views

Privilege escalation vulnerability when administrator access is compromised

panel:borderColor=ff0000|borderStyle=solid|bgColor=ffccccNote: This issue is superceded by JRA-21004. Please install the patches on that issue, rather than this one. For more details, see JIRA Security Advisory -...

0.4AI score
SaveExploits0
Atlassian
Atlassian
•added 2010/03/23 2:46 p.m.•30 views

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

3.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/03/23 2:46 p.m.•30 views

Allow non-Administrators to be able to modify workflows

As an IT Manager, by having to add users to the Administrators group in order to edit and manage workflows is prohibitive to the administration and security of our Jira environment. While I want users to create, manage and edit workflows, I do NOT want them creating or modifying accounts which...

3.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
•added 2010/03/16 1:00 a.m.•30 views

Custom fileds inconsistently escaped in view and edit screens

Steps to replicate: Create a custom field and name it Hithere On view issue screens, the field appears as Hithere On edit issue screen, the field appears as Hithere on red font I guess we need to make a decision on which one is the desired functionality allow HTML or not and make it consistent...

0.7AI score
SaveExploits0Affected Software1
Total number of security vulnerabilities4730