Atlassian

Confluence

35 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2019-3394

  • EPSS 11.02%
  • Veröffentlicht 29.08.2019 15:15:11
  • Zuletzt bearbeitet 21.11.2024 04:42:01

There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a page is able to exploit this issue to read arbitrary file on the server under <install-direct...

9.8

CVE-2019-3395

  • EPSS 6.71%
  • Veröffentlicht 25.03.2019 19:29:01
  • Zuletzt bearbeitet 21.11.2024 04:42:01

The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fixed version for 6.8.x), and from version 6.9.0 before 6.9.3 (the fixed version for 6.9.x) al...

4.7

CVE-2018-13389

  • EPSS 1%
  • Veröffentlicht 10.07.2018 13:29:00
  • Zuletzt bearbeitet 21.11.2024 03:47:00

The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml.

4.8

CVE-2017-18084

  • EPSS 0.6%
  • Veröffentlicht 02.02.2018 14:29:01
  • Zuletzt bearbeitet 21.11.2024 03:19:19

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the description of a macro.

5.4

CVE-2017-18083

  • EPSS 0.58%
  • Veröffentlicht 02.02.2018 14:29:01
  • Zuletzt bearbeitet 21.11.2024 03:19:19

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of an uploaded file.

6.1

CVE-2017-18085

  • EPSS 0.81%
  • Veröffentlicht 02.02.2018 14:29:01
  • Zuletzt bearbeitet 21.11.2024 03:19:19

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter.

6.1

CVE-2017-18086

  • EPSS 0.81%
  • Veröffentlicht 02.02.2018 14:29:01
  • Zuletzt bearbeitet 21.11.2024 03:19:19

Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuesURL parameter.

6.1

CVE-2017-16856

  • EPSS 0.81%
  • Veröffentlicht 05.12.2017 16:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on th...

4.3

CVE-2017-9505

Exploit
  • EPSS 1.26%
  • Veröffentlicht 15.06.2017 16:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments. An attacker who can login to Confluence could receive workbox notifications, which co...

5.4

CVE-2016-4317

  • EPSS 0.71%
  • Veröffentlicht 10.04.2017 03:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.