CVSS: 10.0EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26137
https://notcve.org/view.php?id=CVE-2022-26137
20 Jul 2022 — A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into re... • https://jira.atlassian.com/browse/BAM-21795 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-346: Origin Validation Error •
CVSS: 10.0EPSS: 0%CPEs: 42EXPL: 0CVE-2022-26136
https://notcve.org/view.php?id=CVE-2022-26136
20 Jul 2022 — A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions ar... • https://jira.atlassian.com/browse/BAM-21795 • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 97%CPEs: 14EXPL: 75CVE-2022-26134 – Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-26134
03 Jun 2022 — In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1. En las versiones afectadas de Confluence Server y Data Center, se presenta un... • https://packetstorm.news/files/id/167431 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-39114
https://notcve.org/view.php?id=CVE-2021-39114
05 Apr 2022 — Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los usuarios con una cuenta válida en una ins... • https://jira.atlassian.com/browse/CONFSERVER-68844 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-43940
https://notcve.org/view.php?id=CVE-2021-43940
15 Feb 2022 — Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los atacantes locales autentificado... • https://jira.atlassian.com/browse/CONFSERVER-66550 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 97%CPEs: 8EXPL: 46CVE-2021-26084 – Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-26084
30 Aug 2021 — In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. En las versiones afectadas de Confluence Server y Data Center, se presenta una vulnerabilidad de inyección OGNL que permitiría a un usuar... • https://packetstorm.news/files/id/164122 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 5.3EPSS: 95%CPEs: 4EXPL: 5CVE-2021-26085 – Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2021-26085
03 Aug 2021 — Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server permiten a los atacantes remotos visualizar recursos restringidos por medio de una vulnerabilidad de lectura arbitraria de archivos de autorización previa en el endpoint /s/. Las versio... • https://packetstorm.news/files/id/164401 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-29445
https://notcve.org/view.php?id=CVE-2020-29445
07 May 2021 — Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters. Las versiones afectadas de Confluence Server anteriores a la 7.4.8, y las versiones de la 7.5.0 anteriores a la 7.11.0 permiten a los atacantes identificar hosts y puertos internos a través de una vulnerabilidad de falsificación de solicitudes del lado del servidor en los parámetros ... • https://jira.atlassian.com/browse/CONFSERVER-61453 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-29444
https://notcve.org/view.php?id=CVE-2020-29444
07 May 2021 — Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters. Unas versiones afectadas de Team Calendar en Confluence Server anteriores a 7.11.0, permiten a atacantes inyectar HTML o Javascript arbitrario por medio de una vulnerabilidad de tipo Cross Site Scripting en parámetros de configuración global de administración • https://jira.atlassian.com/browse/CONFSERVER-61266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26072
https://notcve.org/view.php?id=CVE-2021-26072
01 Apr 2021 — The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability. El plugin WidgetConnector en Confluence Server y Confluence Data Center anterior a versión 5.8.6, permitía a atacantes remotos manipular el contenido de los recursos de la red interna a través de una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) ciega del servi... • https://jira.atlassian.com/browse/CONFSERVER-61399 • CWE-918: Server-Side Request Forgery (SSRF) •