DeutschShown in its original language — a full translation is planned for a future version.
Atlassian Bamboo und Confluence (Data Center und Server): Mehrere Schwachstellen
view advisory published 2026-02-17
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo und Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-66021US | medium6.1 | — | ||
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS.… | ||||
| CVE-2025-59343US | — | — | ||
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictab… | ||||
| CVE-2025-41249US | —OT elevated | Exploit | ||
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics… | ||||
| CVE-2025-48976US | — | Exploit | ||
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.
This issue affects Apache Commons FileUpload: from… | ||||
| CVE-2022-25883US | high7.5 | — | ||
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ran… | ||||
| CVE-2022-25927US | high7.5 | Exploit | ||
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() funct… | ||||
| CVE-2020-28469US | high7.5 | — | ||
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. | ||||
02
references
External citations — patches, advisories, analysis.
- Atlassian Security Bulletin vom 2026-02-17external
- Atlassian Security Bulletin - March 17 2026external
- PoC CVE-2025-66021 vom 2026-02-17external
- PoC CVE-2020-28469 vom 2026-02-17external
- PoC CVE-2022-25883 vom 2026-02-17external
- PoC CVE-2022-25927 vom 2026-02-17external
- WID-SEC-W-2026-0438 - CSAF Versionself
- WID-SEC-2026-0438 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan