CVSS: 9.8EPSS: 97%CPEs: 8EXPL: 27CVE-2021-26084 – Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
https://notcve.org/view.php?id=CVE-2021-26084
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. En las versiones afectadas de Confluence Server y Data Center, se presenta una vulnerabilidad de inyección OGNL que permitiría a un usuario no autenticado ejecutar código arbitrario en una instancia de Confluence Server o Data Center. Las versiones afectadas son las versiones anteriores a 6.13.23, desde versiones 6.14.0 anteriores a 7.4.11, desde versiones 7.5.0 anteriores a 7.11.6 y desde versiones 7.12.0 anteriores a 7.12.5. Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code. • https://www.exploit-db.com/exploits/50243 https://github.com/0xf4n9x/CVE-2021-26084 https://github.com/dinhbaouit/CVE-2021-26084 https://github.com/1ZRR4H/CVE-2021-26084 https://github.com/dorkerdevil/CVE-2021-26084 https://github.com/crowsec-edtech/CVE-2021-26084 https://github.com/taythebot/CVE-2021-26084 https://github.com/lleavesl/CVE-2021-26084 https://github.com/CrackerCat/CVE-2021-26084 https://github.com/Loneyers/CVE-2021-26084 https://github.com/b1gw00d/C • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 5.3EPSS: 95%CPEs: 4EXPL: 4CVE-2021-26085 – Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2021-26085
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server permiten a los atacantes remotos visualizar recursos restringidos por medio de una vulnerabilidad de lectura arbitraria de archivos de autorización previa en el endpoint /s/. Las versiones afectadas son anteriores a la versión 7.4.10 y desde la versión 7.5.0 anteriores a 7.12.3 Atlassian Confluence Server version 7.5.1 suffers from a pre-authorization arbitrary file read vulnerability. Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. • https://www.exploit-db.com/exploits/50377 https://github.com/ColdFusionX/CVE-2021-26085 https://github.com/zeroc00I/CVE-2021-26085 http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html https://jira.atlassian.com/browse/CONFSERVER-67893 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-29445
https://notcve.org/view.php?id=CVE-2020-29445
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters. Las versiones afectadas de Confluence Server anteriores a la 7.4.8, y las versiones de la 7.5.0 anteriores a la 7.11.0 permiten a los atacantes identificar hosts y puertos internos a través de una vulnerabilidad de falsificación de solicitudes del lado del servidor en los parámetros de Team Calendars • https://jira.atlassian.com/browse/CONFSERVER-61453 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-29444
https://notcve.org/view.php?id=CVE-2020-29444
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters. Unas versiones afectadas de Team Calendar en Confluence Server anteriores a 7.11.0, permiten a atacantes inyectar HTML o Javascript arbitrario por medio de una vulnerabilidad de tipo Cross Site Scripting en parámetros de configuración global de administración • https://jira.atlassian.com/browse/CONFSERVER-61266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26072
https://notcve.org/view.php?id=CVE-2021-26072
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability. El plugin WidgetConnector en Confluence Server y Confluence Data Center anterior a versión 5.8.6, permitía a atacantes remotos manipular el contenido de los recursos de la red interna a través de una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) ciega del servidor. • https://jira.atlassian.com/browse/CONFSERVER-61399 • CWE-918: Server-Side Request Forgery (SSRF) •