CVE-2022-26136

CVE-2022-26136 is a vulnerability in multiple Atlassian products where remote, unauthenticated attackers can bypass Servlet Filters used by first and third‑party apps, potentially causing authentication bypass and XSS. Affected products and fixed ranges are provided: Atlassian Bamboo (<8.0.9, ...

CVE-2022-26137

CVE-2022-26137 concerns multiple Atlassian products (Bamboo, Bitbucket, Confluence, Jira, Jira Service Management, Crowd, Fisheye/Crucible) where an unauthenticated remote attacker can trigger additional Servlet Filters in requests/responses, causing a CORS bypass. The issue allows an attacker to...

CVE-2019-15005

The CVE-2019-15005 vulnerability concerns the Atlassian Troubleshooting and Support Tools (ATST) plugin prior to version 1.17.2, which is bundled with multiple Atlassian products. An unprivileged user can initiate periodic log scans and have the results emailed to a user-specified address due to ...

CVE-2017-18087

The CVE-2017-18087 entry concerns Atlassian Bitbucket Server. The download commit resource vulnerability in Bitbucket Server affects 5.1.0–5.1.7, 5.2.0–5.2.5, 5.3.0–5.3.3, and 5.4.0–5.4.1. An argument injection in the at parameter can be exploited by remote attackers to write files to disk and po...

CVE-2020-36233

CVE-2020-36233 affects Atlassian Bitbucket on Windows where the Windows Installer creates weak ACLs in the installation directory, enabling local privilege escalation. Affected Bitbucket Server/Data Center installers include all versions prior to 6.10.9, 7.x prior to 7.6.4, and 7.7.0 up to 7.10.0...

CVE-2018-5225

The vulnerability CVE-2018-5225 affects Atlassian Bitbucket Server and allows authenticated users to achieve remote code execution via the in-browser editing feature by editing a symbolic link within a repository. Affected ranges include Bitbucket Server 4.13.0–5.4.7, 5.5.0–5.5.7, 5.6.0–5.6.4, 5....

CVE-2017-18036

The vulnerability CVE-2017-18036 affects Atlassian Bitbucket Server, specifically the Github repository importer module, where a Server-Side Request Forgery (SSRF) in versions before 5.3.0 enables remote attackers to determine whether a non-reachable service has open ports. The root cause is an S...

CVE-2017-18038

Affected software: Atlassian Bitbucket Server (before 5.6.0). Vulnerability: repository settings resource allows path traversal via the default branch name, enabling remote attackers to read the first line of arbitrary files. Root cause: path traversal in the repository settings resource. Impact:...

CVE-2016-4320

CVE-2016-4320 affects Atlassian Bitbucket Server prior to 4.7.1. A directory traversal in the pull requests resource allows remote attackers to read the first line of an arbitrary file, leaking partial confidentiality. The issue is triggered via a directory traversal path and is limited to the fi...