CVE-2019-15005

The CVE-2019-15005 vulnerability concerns the Atlassian Troubleshooting and Support Tools (ATST) plugin prior to version 1.17.2, which is bundled with multiple Atlassian products. An unprivileged user can initiate periodic log scans and have the results emailed to a user-specified address due to ...

CVE-2021-26067

CVE-2021-26067 affects Atlassian Bamboo before 7.2.2, where an unauthenticated attacker can trigger a stack trace through the /chart endpoint, potentially exposing the home directory path and certain files in the tmp directory (Sensitive Data Exposure). The issue is rooted in the handling of the ...

CVE-2012-2926

CVE-2012-2926 covers multiple Atlassian products (JIRA <5.0.1; Confluence pre-3.5.16, 4.0.x <4.0.7, 4.1.x <4.1.10; FishEye/Crucible, Bamboo <3.3.4/3.4.x; Crowd <2.0.9, <2.1.2, <2.2.9, <2.3.7,

CVE-2017-18081

Affected product: Atlassian Bamboo (signupUser resource). Vulnerable in versions before 6.3.1 due to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/JavaScript via the csrf token cookie value. Impact is the ability to execute script in a victim’s browser, p...

CVE-2017-14589

CVE-2017-14589: Atlassian Bamboo is affected by a remote code execution issue caused by double OGNL evaluation in FreeMarker templates via Struts FreeMarker tags. Affected versions are Bamboo < 6.1.6 and 6.2.0 ≤ Bamboo

CVE-2017-18042

CVE-2017-18042 concerns Atlassian Bamboo prior to 6.3.1. The vulnerability is a CSRF in the update user administration resource, allowing remote attackers to modify user data, including passwords. Affected: Bamboo versions before 6.3.1. Root cause: CSRF in the update user admin endpoint. Impact: ...

CVE-2017-18040

The vulnerability CVE-2017-18040 affects Atlassian Bamboo prior to version 6.2.0, in the viewDeploymentVersionCommits resource. It enables remote attackers to perform cross-site scripting by injecting arbitrary HTML/JavaScript via the name of a release. The issue is documented across multiple sou...

CVE-2017-18041

An XSS vulnerability exists in Atlassian Bamboo before 6.2.0 in the viewDeploymentVersionJiraIssuesDialog resource, allowing remote attackers to inject arbitrary HTML/JavaScript via the release name. Affected: Bamboo

CVE-2017-18082

The CVE-2017-18082 vulnerability affects Atlassian Bamboo’s plan configure branches resource. Versions prior to 6.2.3 are vulnerable to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML or JavaScript via the name of a branch. Mitigation: upgrade Bamboo to 6.2...

CVE-2017-18080

Atlassian Bamboo contains a CSRF vulnerability in the saveConfigureSecurity resource, affecting versions before 6.3.1. The issue allows remote attackers to modify security settings. Remediation: upgrade to Bamboo 6.3.1 or later (no other mitigations detailed in the provided docs).