Vulnerabilities > Atlassian > Confluence Data Center

DATE CVE VULNERABILITY TITLE RISK
2023-07-18 CVE-2023-22505 Unspecified vulnerability in Atlassian Confluence Data Center and Confluence Server
This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Center & Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that you upgrade your instance to latest version.
network
low complexity
atlassian
8.8
2023-05-01 CVE-2023-22503 Unspecified vulnerability in Atlassian Confluence Data Center
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space.
network
low complexity
atlassian
5.3
2022-11-15 CVE-2022-42977 Path Traversal vulnerability in Atlassian Confluence Data Center
The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it.
network
low complexity
atlassian CWE-22
7.5
2022-11-15 CVE-2022-42978 Incorrect Authorization vulnerability in Atlassian Confluence Data Center
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled.
network
low complexity
atlassian CWE-863
7.5
2022-07-26 CVE-2020-36290 Cross-site Scripting vulnerability in Atlassian Confluence Data Center and Confluence Server
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.
network
low complexity
atlassian CWE-79
5.4
2022-07-20 CVE-2022-26136 Improper Authentication vulnerability in Atlassian products
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.
network
low complexity
atlassian CWE-287
critical
9.8
2022-07-20 CVE-2022-26137 Origin Validation Error vulnerability in Atlassian products
A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.
network
low complexity
atlassian CWE-346
8.8
2022-06-03 CVE-2022-26134 Expression Language Injection vulnerability in Atlassian Confluence Data Center and Confluence Server
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance.
network
low complexity
atlassian CWE-917
critical
9.8
2022-04-05 CVE-2021-39114 Code Injection vulnerability in Atlassian Confluence Data Center and Confluence Server
Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to execute arbitrary Java code or run arbitrary system commands by injecting an OGNL payload.
network
low complexity
atlassian CWE-94
8.8
2022-02-15 CVE-2021-43940 Uncontrolled Search Path Element vulnerability in Atlassian Confluence Data Center
Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer.
local
low complexity
atlassian CWE-427
7.8