Vulnerabilidades em Atlassian

409 resultados
Análise Vexday

Com 13 CVEs confirmadas em exploração ativa pelo CISA KEV de um total de 399 catalogadas, a taxa de exploração do portfólio Atlassian é 7,2 vezes acima da média geral do catálogo, o que indica atenção elevada por parte de agentes maliciosos a vulnerabilidades nesse ecossistema. O tipo de falha mais recorrente é CWE-863 (Autorização Incorreta), sugerindo deficiências estruturais em controles de acesso que tendem a ter impacto amplo em ambientes colaborativos. A CVE mais crítica em exploração ativa, CVE-2021-26084, apresenta EPSS máximo de 1,0 — indicador de probabilidade praticamente certa de exploração em campo —, o que a coloca como prioridade absoluta de remediação para qualquer organização que ainda não tenha aplicado os patches correspondentes. Com 19 vulnerabilidades com PoC pública e 22 de severidade crítica no portfólio total, a superfície de risco permanece significativa e exige monitoramento contínuo.

CVE-2017-18093—Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackeEPSS 0.8%CVE-2019-11587—Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version EPSS 0.8%CVE-2021-43949—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vEPSS 0.8%CVE-2021-43951—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conEPSS 0.8%CVE-2019-11588—The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from versionEPSS 0.8%CVE-2021-41309MEDIUMAffected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export aEPSS 0.8%CVE-2018-13394—The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated toEPSS 0.8%CVE-2020-14170—Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netwEPSS 0.8%CVE-2017-18103—The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the EPSS 0.8%CVE-2017-9508—Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via aEPSS 0.8%CVE-2017-9510—The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vEPSS 0.8%CVE-2017-9509—The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript viEPSS 0.8%CVE-2017-9507—The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTMLEPSS 0.8%CVE-2019-20098—The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site EPSS 0.8%CVE-2017-16856—The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross sitEPSS 0.8%CVE-2017-18085—The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JaEPSS 0.8%CVE-2017-16863—The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site sEPSS 0.8%CVE-2017-18081—The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross EPSS 0.8%CVE-2021-39119MEDIUMAffected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue EPSS 0.8%CVE-2021-39124—The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attEPSS 0.8%