CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-43940
https://notcve.org/view.php?id=CVE-2021-43940
15 Feb 2022 — Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los atacantes locales autentificado... • https://jira.atlassian.com/browse/CONFSERVER-66550 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 94%CPEs: 8EXPL: 46CVE-2021-26084 – Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-26084
30 Aug 2021 — In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. En las versiones afectadas de Confluence Server y Data Center, se presenta una vulnerabilidad de inyección OGNL que permitiría a un usuar... • https://packetstorm.news/files/id/164122 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 5.3EPSS: 94%CPEs: 4EXPL: 5CVE-2021-26085 – Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2021-26085
03 Aug 2021 — Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server permiten a los atacantes remotos visualizar recursos restringidos por medio de una vulnerabilidad de lectura arbitraria de archivos de autorización previa en el endpoint /s/. Las versio... • https://packetstorm.news/files/id/164401 • CWE-425: Direct Request ('Forced Browsing') •