DeutschShown in its original language — a full translation is planned for a future version.
Atlassian Bamboo: Mehrere Schwachstellen
view advisory published 2024-01-15
Ein entfernter Angreifer kann mehrere Schwachstellen in Atlassian Bamboo ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Request Smuggling-Angriff durchzuführen.
01
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-46589US | high7.5 | — | ||
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 throu… | ||||
| CVE-2023-5072US | high7.5 | — | ||
Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an input string of modest size can lead to indefinite amounts of memory being… | ||||
| CVE-2023-36478US | high7.5 | — | ||
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBui… | ||||
| CVE-2023-39410US | high7.5 | — | ||
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
This iss… | ||||
| CVE-2022-4244US | high7.5 | Exploit | ||
A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manip… | ||||
| CVE-2022-40152US | high7.5 | — | ||
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker… | ||||
| CVE-2020-26217US | high8.8 | Exploit | ||
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processe… | ||||
| CVE-2018-10054US | high8.8 | Exploit | ||
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is… | ||||
| CVE-2017-7957US | high7.5 | — | ||
XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a re… | ||||
02
references
External citations — patches, advisories, analysis.
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
- Atlassian Security Advisory vom 2024-01-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan