CVSS: 9.0EPSS: 11%CPEs: 10EXPL: 0CVE-2023-22513
https://notcve.org/view.php?id=CVE-2023-22513
19 Sep 2023 — This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to d... • https://confluence.atlassian.com/pages/viewpage.action?pageId=1283691616 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 2%CPEs: 2EXPL: 0CVE-2023-22506
https://notcve.org/view.php?id=CVE-2023-22506
18 Jul 2023 — This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your ... • https://jira.atlassian.com/browse/BAM-22400 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 2%CPEs: 6EXPL: 0CVE-2023-22508
https://notcve.org/view.php?id=CVE-2023-22508
18 Jul 2023 — This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to avoid this bug using the following options: * Upg... • https://jira.atlassian.com/browse/CONFSERVER-88221 •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2023-22505
https://notcve.org/view.php?id=CVE-2023-22505
18 Jul 2023 — This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to late... • https://jira.atlassian.com/browse/CONFSERVER-88265 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-22503
https://notcve.org/view.php?id=CVE-2023-22503
01 May 2023 — Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature. This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team. The affected versions are before version 7.13.15, from version 7.14.0 before 7.19.7, and from version 7.20.0 before 8.2.0. • https://jira.atlassian.com/browse/CONFSERVER-82403 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-42977
https://notcve.org/view.php?id=CVE-2022-42977
15 Nov 2022 — The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded. El complemento Netic User Export anterior a 1.3.5 para Atlassian Confluence tiene la funcionalidad de generar una lista de usuarios en la aplicación y exportarla. Durante la exportación, la solicitud HTTP tiene un parámetr... • https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-42978
https://notcve.org/view.php?id=CVE-2022-42978
15 Nov 2022 — In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system. En el complemento Netic User Export anterior a 1.3.5 para Atlassian Confluence, la autorización se maneja mal. Un atacante no autenticado podría acceder a archivos del sistema remoto. • https://gist.github.com/CveCt0r/34251664a511f1045ce6a5492e94eec1 • CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 11%CPEs: 2EXPL: 0CVE-2022-36801
https://notcve.org/view.php?id=CVE-2022-36801
10 Aug 2022 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (RXSS) Reflejado en el endpoint TeamM... • https://jira.atlassian.com/browse/JRASERVER-73740 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 2%CPEs: 6EXPL: 0CVE-2022-36799
https://notcve.org/view.php?id=CVE-2022-36799
01 Aug 2022 — This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. In this case the security improvement was to protect against using the XStream library to be able to execute arbitrary code in veloc... • https://jira.atlassian.com/browse/JRASERVER-73582 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-36290
https://notcve.org/view.php?id=CVE-2020-36290
26 Jul 2022 — The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality. Livesearch macro in Confluence Server and Data Center versiones anteriores a 7.4.5, desde versión 7.5.0 anteriores a 7.6.3, y desde versión 7.7.0 anteriores a 7.7.4, permi... • https://jira.atlassian.com/browse/CONFSERVER-60118 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •