Atlassian Confluence
20 CVEs affecting Atlassian Confluence. Latest disclosed: 2020-07-01. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3395 | Critical | 9.8 | 2019-03-25 | The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fix… |
CVE-2012-2926 | Critical | 9.1 | 2012-05-22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 be… |
CVE-2019-3394 | High | 8.8 | 2019-08-29 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a pa… |
CVE-2019-3398 | High | 8.8 | 2019-04-18 | Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attach… |
CVE-2019-20406 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local syst… |
CVE-2019-15006 | Medium | 6.5 | 2019-12-19 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was u… |
CVE-2017-18086 | Medium | 6.1 | 2018-02-02 | Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… |
CVE-2017-18085 | Medium | 6.1 | 2018-02-02 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2017-16856 | Medium | 6.1 | 2017-12-05 | The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) v… |
CVE-2016-6283 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileNa… |
CVE-2015-8398 | Medium | 6.1 | 2016-04-11 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO… |
CVE-2017-18083 | Medium | 5.4 | 2018-02-02 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2016-4317 | Medium | 5.4 | 2017-04-10 | Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. |
CVE-2017-18084 | Medium | 4.8 | 2018-02-02 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2020-4027 | Medium | 4.7 | 2020-07-01 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template in… |
CVE-2018-13389 | Medium | 4.7 | 2018-07-10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attach… |
CVE-2019-15005 | Medium | 4.3 | 2019-11-08 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results… |
CVE-2017-9505 | Medium | 4.3 | 2017-06-15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comm… |
CVE-2015-8399 | Medium | 4.3 | 2016-04-11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecor… |
CVE-2005-3967 | | 2005-12-03 | Cross-site scripting (XSS) vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary… |