Page 2 of 12 results (0.003 seconds)

CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0

CVE-2023-22504

https://notcve.org/view.php?id=CVE-2023-22504

25 May 2023 — Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to upload attachments via a Broken Access Control vulnerability in the attachments feature. • https://jira.atlassian.com/browse/CONFSERVER-83218 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-22503

https://notcve.org/view.php?id=CVE-2023-22503

01 May 2023 — Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0. • https://jira.atlassian.com/browse/CONFSERVER-82403 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •