Page 3 of 17 results (0.016 seconds)

CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0

CVE-2021-39114

https://notcve.org/view.php?id=CVE-2021-39114

Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los usuarios con una cuenta válida en una instancia de Confluence Data Center ejecutar código Java arbitrario o ejecutar comandos del sistema arbitrarios mediante la inyección de una carga útil OGNL. Las versiones afectadas son las versiones anteriores a 6.13.23, desde la versión 6.14.0 hasta la 7.4.11, desde la versión 7.5.0 hasta la 7.11.6 y desde la versión 7.12.0 hasta la 7.12.5 • https://jira.atlassian.com/browse/CONFSERVER-68844 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0

CVE-2021-43940

https://notcve.org/view.php?id=CVE-2021-43940

Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los atacantes locales autentificados conseguir privilegios elevados en el sistema local a través de una vulnerabilidad de DLL Hijacking en el instalador de Confluence. Esta vulnerabilidad sólo afecta a las instalaciones de Confluence Server y Data Center en Windows. • https://jira.atlassian.com/browse/CONFSERVER-66550 • CWE-427: Uncontrolled Search Path Element •

CVSS: 9.8EPSS: 97%CPEs: 8EXPL: 28

CVE-2021-26084 – Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

https://notcve.org/view.php?id=CVE-2021-26084

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. En las versiones afectadas de Confluence Server y Data Center, se presenta una vulnerabilidad de inyección OGNL que permitiría a un usuario no autenticado ejecutar código arbitrario en una instancia de Confluence Server o Data Center. Las versiones afectadas son las versiones anteriores a 6.13.23, desde versiones 6.14.0 anteriores a 7.4.11, desde versiones 7.5.0 anteriores a 7.11.6 y desde versiones 7.12.0 anteriores a 7.12.5. Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. • https://www.exploit-db.com/exploits/50243 https://github.com/0xf4n9x/CVE-2021-26084 https://github.com/dinhbaouit/CVE-2021-26084 https://github.com/1ZRR4H/CVE-2021-26084 https://github.com/dorkerdevil/CVE-2021-26084 https://github.com/crowsec-edtech/CVE-2021-26084 https://github.com/taythebot/CVE-2021-26084 https://github.com/lleavesl/CVE-2021-26084 https://github.com/CrackerCat/CVE-2021-26084 https://github.com/Loneyers/CVE-2021-26084 https://github.com/b1gw00d/C • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •

CVSS: 5.3EPSS: 95%CPEs: 4EXPL: 4

CVE-2021-26085 – Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability

https://notcve.org/view.php?id=CVE-2021-26085

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server permiten a los atacantes remotos visualizar recursos restringidos por medio de una vulnerabilidad de lectura arbitraria de archivos de autorización previa en el endpoint /s/. Las versiones afectadas son anteriores a la versión 7.4.10 y desde la versión 7.5.0 anteriores a 7.12.3 Atlassian Confluence Server version 7.5.1 suffers from a pre-authorization arbitrary file read vulnerability. Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. • https://www.exploit-db.com/exploits/50377 https://github.com/ColdFusionX/CVE-2021-26085 https://github.com/zeroc00I/CVE-2021-26085 http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html https://jira.atlassian.com/browse/CONFSERVER-67893 • CWE-425: Direct Request ('Forced Browsing') •

CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-29444

https://notcve.org/view.php?id=CVE-2020-29444

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters. Unas versiones afectadas de Team Calendar en Confluence Server anteriores a 7.11.0, permiten a atacantes inyectar HTML o Javascript arbitrario por medio de una vulnerabilidad de tipo Cross Site Scripting en parámetros de configuración global de administración • https://jira.atlassian.com/browse/CONFSERVER-61266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •