CVSS: 9.8EPSS: 86%CPEs: 5EXPL: 2CVE-2022-26133
https://notcve.org/view.php?id=CVE-2022-26133
20 Apr 2022 — SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization. SharedSecretClusterAuthenticator en Atlassian Bitbucket Data Center versiones 5.14.0 y posteriores anteriores a 7.6.14, versiones 7.7.0 y posteriores anteriores a 7.17.6, versiones 7.18.0 y posterio... • https://github.com/Pear1y/CVE-2022-26133 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 93%CPEs: 12EXPL: 1CVE-2022-0540
https://notcve.org/view.php?id=CVE-2022-0540
20 Apr 2022 — A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Una vulnerabilidad en... • https://github.com/Pear1y/CVE-2022-0540-RCE • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-39114
https://notcve.org/view.php?id=CVE-2021-39114
05 Apr 2022 — Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los usuarios con una cuenta válida en una ins... • https://jira.atlassian.com/browse/CONFSERVER-68844 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2021-43958
https://notcve.org/view.php?id=CVE-2021-43958
16 Mar 2022 — Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability. Varios recursos de reposo en Fisheye y Crucible versiones anteriores a 4.8.9 permitían a atacantes remotos forzar las cr... • https://jira.atlassian.com/browse/CRUC-8523 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43957
https://notcve.org/view.php?id=CVE-2021-43957
16 Mar 2022 — Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9. Las versiones afectadas de Atlassian Fisheye y Crucible permitían a atacantes remotos navegar por archivos locales por medio de una vulnerabilidad de Insecure Direct Object References (IDOR) en el directorio WEB... • https://jira.atlassian.com/browse/CRUC-8524 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43956
https://notcve.org/view.php?id=CVE-2021-43956
16 Mar 2022 — The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability. La biblioteca jQuery deserialize en Fisheye y Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos inyectar HTML y/o JavaScript arbitrario por medio de una vulnerabilidad de contaminación de prototipos • https://jira.atlassian.com/browse/CRUC-8531 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43955
https://notcve.org/view.php?id=CVE-2021-43955
16 Mar 2022 — The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability. El recurso /rest-service-fecru/server-v1 en Fisheye y Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos autenticados obtener información sobre los directorios de instalación por medio de una vulnerabilidad de divulgación de información • https://jira.atlassian.com/browse/CRUC-8533 •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43954
https://notcve.org/view.php?id=CVE-2021-43954
14 Mar 2022 — The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability. La clase DefaultRepositoryAdminService en Fisheye and Crucible versiones anteriores a 4.8.9, permitía a atacantes remotos, que tuvieran el permiso "can add repository permission", enumerar la existencia de recursos internos de red ... • https://jira.atlassian.com/browse/CRUC-8520 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43944
https://notcve.org/view.php?id=CVE-2021-43944
08 Mar 2022 — This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Este problema se presenta para documentar q... • https://jira.atlassian.com/browse/JRASERVER-73072 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43945
https://notcve.org/view.php?id=CVE-2021-43945
28 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con permisos de administrador de hojas de ruta inyectar HTML o JavaScript arbitrarios por medio de un... • https://jira.atlassian.com/browse/JRASERVER-73069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •