Lucene search
+L
AtlassianMost viewed

4567 matches found

Atlassian
Atlassian
added 2015/02/26 12:09 a.m.23 views

XSRF - complete task request omits atl-token

Potential XSRF vulnerability in tasks. No atl-token is present in the request to complete a task which suggests an attacker may be able to craft a cross site request forgery and action a task without the correct authorisation...

3.4AI score
SaveExploits0
Atlassian
Atlassian
added 2015/01/23 5:27 a.m.23 views

Drop SSlv3 retry and copied CustomSSLProtocolSocketFactory.java from SAL

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-36250. panel The fix for CONF-24035 introduced a retry with SSLv3 if a connection fails. However, like workaround implemented i...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2015/01/23 5:27 a.m.23 views

Drop SSlv3 retry and copied CustomSSLProtocolSocketFactory.java from SAL

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-36250. panel The fix for CONF-24035 introduced a retry with SSLv3 if a connection fails. However, like workaround implemented in...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2015/01/23 5:27 a.m.23 views

Drop SSlv3 retry and copied CustomSSLProtocolSocketFactory.java from SAL

The fix for CONF-24035 introduced a retry with SSLv3 if a connection fails. However, like workaround implemented in SAL-203 there is no need to retry with SSLv3 - instead enabling TLSv1.1 or higher will address the issue. The issue is actually caused by java not following the TLS rfc. When TLSv1....

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2015/01/14 11:25 a.m.23 views

Disable SSLv3 in outgoing HTTPS connections from Confluence

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-36165. panel SSLv3 is an old protocol and has been superseded by TLSv1.0, TLSv1.1 and TLSv1.2. TLSv1.0 was first defined in...

0.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2015/01/14 11:25 a.m.23 views

Disable SSLv3 in outgoing HTTPS connections from Confluence

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-36165. panel SSLv3 is an old protocol and has been superseded by TLSv1.0, TLSv1.1 and TLSv1.2. TLSv1.0 was first defined in...

0.2AI score
SaveExploits0
Atlassian
Atlassian
added 2014/12/18 3:41 a.m.23 views

Use of atlassian-whitelist plugin allows CORS access to origins which it should not

The ApplicationLinkMatcher class|https://bitbucket.org/atlassian/atlassian-whitelist/src/9ba2728450d8fe880d3d30e74cc0c75a427e66fb/atlassian-whitelist-api-plugin/src/main/java/com/atlassian/plugins/whitelist/applinks/ApplicationLinkMatcher.java?at=master and the SelfUrlMatcher...

6.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/12/16 12:06 a.m.23 views

OGNL Double Evaluation Vulnerability

We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to be able to access the Crucible web interface. All versions of Crucible up to and including 3.6.1...

3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/11/14 3:04 p.m.23 views

XSS vulnerability in spacedirectory

Good morning, I wanted to tell you to run vulnerability tests confluence, thrown the same XSS vulnerabilities. Version tested: 5.4.4 What steps should I follow to fix their vulnerabilities? Or vulnerabilities will be resolved for you? I attached the vulnerabilities: 1 GET...

2.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/10/27 10:01 p.m.23 views

HTML does not render in Project Description

If you enter HTML into the project description it does not get rendered. Reproduced this on a clean 6.3.8 instance. Looks like this has happened in the past: https://jira.atlassian.com/browse/JRA-20032 https://jira.atlassian.com/browse/JRA-15906 Regression? Or possibly a different root cause?...

0.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/10/24 7:13 p.m.23 views

SSLv3 Is Not Disabled When sslProtocol is Set to TLS, Vulnerable to POODLE

The default connector as written in /conf/server.xml uses sslProtocol="TLS". This should only enable TLS connectors, but it also enables SSLv3. Our documentation and the included server.xml need to be updated to reflect the correct settings to enable only TLS. h3. Reproduction steps: Follow the...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/10/20 8:42 p.m.23 views

XSS in page editor via Shortcut links

Steps to reproduce: 1. add new shortcuts with default alias like "". 2. by typing searchterms@aliasname in page editor you can trigger XSS By replacing existing shortcut with malicious one, we can easily exploit multiple users using this functionality...

2.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/10/10 12:43 p.m.23 views

Stash email settings fields can be inadvertently be populated by browser with user login details - security issue

The email and username password in the email server settings screen has the same names as the username and password fields when logging in. This has the unintentional side affect of being pre-populated by your browser if you have left the mail server credentials blank and your browser has saved...

1.5AI score
SaveExploits0
Atlassian
Atlassian
added 2014/10/07 4:08 a.m.23 views

"Recently updated" plugin can be used to reflect arbitrary static content to browser

This request: noformat /plugins/recently-updated/changes.action?theme=XXXXXXXX noformat results in the response: noformat HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: no-cache, must-revalidate Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Confluence-Request-Time: 1412654577325...

0.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/09/10 9:23 a.m.23 views

Disabled users still recieve 'Share Page' emails sent to groups

Steps to Reproduce in Confluence: Create a user, and set to 'Disabled' Create a Group and make this user a member of this group Share a page with the group This results in an email being sent to the inactive user Steps to Reproduce with a Crowd server handling user management: Same as above, but...

1.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/09/06 3:12 p.m.23 views

Tools/Share sends e-mail to disabled users

I have Confluence/JIRA latest versions self hosted. Confluence gets its users from JIRA. I created a new topic and then used the Tools/Share option to notify all of the new topic. I used "jira-users" to send the message to. It sent to everyone including disabled users. I would expect the behavior...

0.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/07/29 4:12 a.m.23 views

Escape or filter script tags in "all activity" panel

We've got an external report about a third party plugin: quote From: Vincent Ollivier Date: 29 July 2014 13:12 Subject: JIRA 6.2.5 / JEditor XSS Vulnerability To: [email protected] Hi, Sorry for the email, I couldn't find the correct project to report this security issue. There's an XSS in...

6.1AI score
SaveExploits0
Atlassian
Atlassian
added 2014/07/01 6:02 p.m.23 views

Make categories in Space Directory visible only to users who can access the spaces

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-34136. panel Anonymous users can see a list of categories in the Space Directory, even though they don't see the spaces...

3.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/06/10 5:53 a.m.23 views

XSS in FilterSubscription

h4. To reproduce: Visit: code:none /secure/FilterSubscription!default.jspa?returnUrl=javascript:alert1 code Click "Cancel" An alert should appear This URL should be restricted to the current domain, and to http/https protocols...

2.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/06/09 12:56 p.m.23 views

statTypes REST API exposes all statistics field names anonymously

On an instance with no anonymous access enabled, /rest/gadget/1.0/statTypes returns a list of all stattable custom fields names and IDs in the instance in response to anonymous requests. This is a nasty exposure of data - admins have no way of knowing that private data shouldn't be put into custo...

1.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/04/29 2:00 a.m.23 views

Open redirect in JIRA in HTTPS mode only

If JIRA is configured for HTTPS connections in both "redirect HTTP to HTTPS" and "HTTPS only" modes, then the following redirects are possible. This does not occur in HTTP configs. The osdestination parameter on the login.jsp page and other pages once logged in - see technical details below allow...

1AI score
SaveExploits0
Atlassian
Atlassian
added 2014/03/27 2:46 a.m.23 views

Any user without permission to view the page can view its label

h4. Steps to Reproduce: Create a Page with user A Add a label to the page Assign Page Restrictions Restrict viewing to me Login with user B user B can see all labels including label of user A's page h4. Expected Results: Described that "Global labels are visible to all users with 'view' permissio...

0.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2014/02/20 4:09 p.m.23 views

Restricted JIRA comments appear in Confluence notification inbox

If a user is watching a JIRA issue, and a restricted comment is made on that issue that the user should not be able to see, the notification still appears in their Confluence notification inbox. When the user navigates to the issue, the correctly are not allowed to see the comment. This is a...

2.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/29 6:54 a.m.23 views

UploadAction.execute vulnerable to CSRF

Sub-issue from CONF-27960. UploadAction.execute upload.action does not have CSRF protection...

2.5AI score
SaveExploits0
Atlassian
Atlassian
added 2013/10/10 11:28 p.m.23 views

CSRF in resetstylesheet.action

SpaceEditStylesheetAction.doReset EditStylesheetAction.doReset...

1.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/10 11:05 a.m.23 views

Confluence notifications generated on jira issues no longer readable

A user created a ticket in jira, which was moved to another section, where the creator of the ticket has no rights. But the creator recieved a notification in confluence about a new comment on the ticket, he was no longer able to read and the comment was quoted in confluence. I think, this is a...

1.1AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/02 11:33 a.m.23 views

Jira is logging SOAP body in default config - passwords included

In the default log4j.properties of Jira, there are settings for logging soap dumps. The config file does not explicitly enable the logging of soap dumps, but somehow, this happens, with usernames and passwords. For security, this should be fixed or removed from log4j config...

1.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/01 11:04 a.m.23 views

User lister action has no cross-site request forgery (XSRF) protection

Confluence allows an administrator to configure the groups which will not be allowed for member listing by the userlister macro. The doconfigure action that implements this functionality is vulnerable to cross-site request forgery XSRF. An attacker who exploited this vulnerability could cause the...

1.9AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/01 10:59 a.m.23 views

Inaccessible page titles leaked by Share Page API

The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...

6.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/10/01 9:22 a.m.23 views

RSS Macro should not trust all content from the origin server by default.

The RSS feed macro currently appears to be enabled by default in Confluence. This is contrary to the information contained in the following Confluence documentation: https://confluence.atlassian.com/display/DOC/RSS+Feed+Macro While a whitelist is enforced by default, as confluence implicitly trus...

0.5AI score
SaveExploits0
Atlassian
Atlassian
added 2013/09/30 7:48 a.m.23 views

XSS in admin/ViewIssueFields.jspa

Reproduction: 1. Create custom fields with alert1 in name and/or description. 2. Go to 'Field Configurations' 3. Click 'Add Field Configuration', enter any text in 'Name' 4. Hit okay and wait for the page to refresh 5. Choose the config you just made - XSSed...

0.1AI score
SaveExploits0
Atlassian
Atlassian
added 2013/09/27 6:49 a.m.23 views

SSL Cipher suites are not configurable

Allow SSL cipher suites to be configured, preferably in the administration panel but at a minimum by editing the config.xml. Currently we are relying on the default cipher suites for jetty which includes some outdated ones that are considered insecure these days. See configuring cipher...

1.4AI score
SaveExploits0
Atlassian
Atlassian
added 2013/09/24 8:35 a.m.23 views

Passwords from variables are visible in plaintext in release versioning preview

Hey Atlassians! You can see the contents of masked variables the ones with "password" in their key when you click on "Add variable to version" in release versioning configuration screen for deployment project. Steps to reproduce: 1. Create a global variable with key: "testpassword" and value "abc...

1.4AI score
SaveExploits0
Atlassian
Atlassian
added 2013/09/16 5:41 a.m.23 views

Arbitrary file or URL download in ExportWordPageServer

To reproduce: 1. Create a new page. 2. Insert an image with URL: code:none file:///etc/passwd code Edit the page, click +, click Image, select the From the Web tab, enter the file: URL shown above, click Insert, click Save. The image appears invisible on some browsers, but you can verify its...

0.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/09/16 5:41 a.m.23 views

Arbitrary file or URL download in ExportWordPageServer

To reproduce: 1. Create a new page. 2. Insert an image with URL: code:none file:///etc/passwd code Edit the page, click +, click Image, select the From the Web tab, enter the file: URL shown above, click Insert, click Save. The image appears invisible on some browsers, but you can verify its...

0.2AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/09/04 12:24 a.m.23 views

XSS vulnerability in the Office Powerpoint macro (Office Connector)

To reproduce: 1. Attach a ".ppt" file to the page. any file with that extension - doesn't need to be a powerpoint file 2. Add "Office Powerpoint" macro with Slide Number as: code "alertdocument.domain code 3. View page. See officeconnector, PptConverter.java, line...

2.4AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/09/02 7:10 a.m.23 views

'self' xss reported in a question's moderate

We have received an external report of a dom xss in the moderation code for a question on answers.atlassian.com. quote 1 DOM XSS Go to https://answers.atlassian.com/ Prepare an question ,after savin it go to the question ,there is an option of "Moderate" ,click it ,there is an option to "Create...

0.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/08/23 1:38 a.m.23 views

CSRF in doremoveblogpost.action

Any page can be deleted if a user with sufficient privileges to delete the page clicks an attacker controlled link, or views an image at an attack controller URL. /pages/doremoveblogpost.action?pageId=...

2.5AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/08/13 1:36 a.m.23 views

Convert the SecurityHeadersInterceptor into a filter that applies to /*

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-30356. panel The X-XSS-Protection HTTP header should be sent on all responses with a value of "1; mode=block". As the current...

0.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/08/13 1:36 a.m.23 views

Convert the SecurityHeadersInterceptor into a filter that applies to /*

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-30356. panel The X-XSS-Protection HTTP header should be sent on all responses with a value of "1; mode=block". As the current...

0.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/08/06 5:16 a.m.23 views

XSS in doconfigurerssfeed.action

Filed by vosipov on behalf of write.muhammadwaqar. code...

0.8AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/08/05 9:55 p.m.23 views

Force password reset for all users

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-30236. panel Administrators should have an easy way to force users to change passwords in bulk format in emergencies. Has this...

0.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/07/26 9:52 a.m.23 views

Page Properties Report showing restricted items

Pages using the Page Properties control that are restricted, still display in a page with the Page Properties Report control when they should not. To clarify: A page with the Page Properties Report control that is unrestricted, shows all of the relevant pages within it. However a few of the pages...

1.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/07/26 3:05 a.m.23 views

XSS vulnerabilities in Atlassian Answers

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47042. panel Some users seem to try XSS attack on Atlassian Answers. How to replicate is the following steps. Go to the top page...

2AI score
SaveExploits0
Atlassian
Atlassian
added 2013/07/23 11:42 p.m.23 views

Restricted Work Log entries show in the Activity Stream in JIRA Server

h3. Summary When using a group comment visibility on worklogs the restriction is not applied in the Activity Stream. h3. Steps to Reproduce Set up a test user JIRA Users. Enable comment visibility to support groups as per Configuring JIRA...

2.3AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/06/20 1:38 p.m.23 views

Turning off Anti-XSRF mode has no effect

Turning off Anti-XSRF protection for comments does not have the desired effect. Even if the setting is turned off adding comments is not possible, due to an XSRF warning...

2.3AI score
SaveExploits0
Atlassian
Atlassian
added 2013/06/05 6:39 a.m.23 views

Passwords of configured SMTP mail accounts are stored in cleartext

Passwords for configured mail accounts are stored in clear text in the database as can be seen e.g. by: code SELECT FROM BANDANA WHERE BANDANAKEY = 'atlassian.confluence.space.mailaccounts'; code Even when being an admin I should NOT be able to read-out other users email account password! This...

2.7AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/04/29 3:41 a.m.23 views

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam. ...

1.6AI score
SaveExploits0Affected Software1
Atlassian
Atlassian
added 2013/04/29 3:41 a.m.23 views

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam. ...

1.6AI score
SaveExploits0
Atlassian
Atlassian
added 2013/04/29 3:41 a.m.23 views

SPAM via Answer

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-47171. panel I have received an email notification containing a link as an aswer one of my questions. It turns out that a spam....

1.6AI score
SaveExploits0Affected Software1
Total number of security vulnerabilities4567