CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-43940
https://notcve.org/view.php?id=CVE-2021-43940
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los atacantes locales autentificados conseguir privilegios elevados en el sistema local a través de una vulnerabilidad de DLL Hijacking en el instalador de Confluence. Esta vulnerabilidad sólo afecta a las instalaciones de Confluence Server y Data Center en Windows. • https://jira.atlassian.com/browse/CONFSERVER-66550 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 97%CPEs: 8EXPL: 27CVE-2021-26084 – Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-26084
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. En las versiones afectadas de Confluence Server y Data Center, se presenta una vulnerabilidad de inyección OGNL que permitiría a un usuario no autenticado ejecutar código arbitrario en una instancia de Confluence Server o Data Center. Las versiones afectadas son las versiones anteriores a 6.13.23, desde versiones 6.14.0 anteriores a 7.4.11, desde versiones 7.5.0 anteriores a 7.11.6 y desde versiones 7.12.0 anteriores a 7.12.5. Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. • https://www.exploit-db.com/exploits/50243 https://github.com/0xf4n9x/CVE-2021-26084 https://github.com/dinhbaouit/CVE-2021-26084 https://github.com/1ZRR4H/CVE-2021-26084 https://github.com/dorkerdevil/CVE-2021-26084 https://github.com/crowsec-edtech/CVE-2021-26084 https://github.com/taythebot/CVE-2021-26084 https://github.com/lleavesl/CVE-2021-26084 https://github.com/CrackerCat/CVE-2021-26084 https://github.com/Loneyers/CVE-2021-26084 https://github.com/b1gw00d/C • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 5.3EPSS: 96%CPEs: 4EXPL: 4CVE-2021-26085 – Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2021-26085
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server permiten a los atacantes remotos visualizar recursos restringidos por medio de una vulnerabilidad de lectura arbitraria de archivos de autorización previa en el endpoint /s/. Las versiones afectadas son anteriores a la versión 7.4.10 y desde la versión 7.5.0 anteriores a 7.12.3 Atlassian Confluence Server version 7.5.1 suffers from a pre-authorization arbitrary file read vulnerability. Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. • https://www.exploit-db.com/exploits/50377 https://github.com/ColdFusionX/CVE-2021-26085 https://github.com/zeroc00I/CVE-2021-26085 http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html https://jira.atlassian.com/browse/CONFSERVER-67893 • CWE-425: Direct Request ('Forced Browsing') •