Page 3 of 26 results (0.004 seconds)

CVSS: 8.8EPSS: 78%CPEs: 3EXPL: 2

CVE-2019-3394 – Confluence Server Local File Disclosure

https://notcve.org/view.php?id=CVE-2019-3394

29 Aug 2019 — There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under /confluence/WEB-INF directory, which may contain configuration files used for integrating with other services, which could potentially leak credentials or other sensitive information such as LDAP credentials. The LDAP credential will be potentially leaked on... • https://packetstorm.news/files/id/154278 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 5.4EPSS: 0%CPEs: 14EXPL: 0

CVE-2018-20239

https://notcve.org/view.php?id=CVE-2018-20239

30 Apr 2019 — Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3... • https://ecosystem.atlassian.net/browse/APL-1373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 94%CPEs: 4EXPL: 6

CVE-2019-3398 – Atlassian Confluence Server and Data Center Path Traversal Vulnerability

https://notcve.org/view.php?id=CVE-2019-3398

18 Apr 2019 — Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server... • https://packetstorm.news/files/id/155235 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 10.0EPSS: 94%CPEs: 4EXPL: 26

CVE-2019-3396 – Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

https://notcve.org/view.php?id=CVE-2019-3396

25 Mar 2019 — The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection. La macro de Widget Connector en Atlassian... • https://packetstorm.news/files/id/161065 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.8EPSS: 12%CPEs: 4EXPL: 0

CVE-2019-3395 – Atlassian Confluence SSRF / Remote Code Execution

https://notcve.org/view.php?id=CVE-2019-3395

25 Mar 2019 — The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) allows remote attackers to send arbitrary HTTP and WebDAV requests from a Confluence Server or Data Center instance via Server-Side Request Forgery. El endpoint WebDAV en Atlassian Confluence Server and Data Center en versiones anteriores a la 6.6.7 (la versión so... • https://jira.atlassian.com/browse/CONFSERVER-57971 • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2018-20237

https://notcve.org/view.php?id=CVE-2018-20237

13 Feb 2019 — Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature. Atlassian Confluence Server and Data Center, en versiones anteriores a la 6.13.1, permite que un usuario autenticado descargue una página eliminada mediante la característica de exportación de palabras. • http://www.securityfocus.com/bid/107041 • CWE-668: Exposure of Resource to Wrong Sphere •