High

DATE	CVE	VULNERABILITY TITLE	RISK
2019-03-29	CVE-2017-18111	XXE vulnerability in Atlassian Application Links The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. network low complexity atlassian CWE-611	8.7
2018-04-04	CVE-2017-18096	Server-Side Request Forgery (SSRF) vulnerability in Atlassian Application Links The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. network low complexity atlassian CWE-918	7.2