DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-16
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
01
beschreibt (49)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-44496US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the… | ||||
| CVE-2026-44495US | high7.7 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing.… | ||||
| CVE-2026-44492US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 addre… | ||||
| CVE-2026-44488US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were… | ||||
| CVE-2026-44487US | high7.5 | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected… | ||||
| CVE-2026-44486US | — | — | ||
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affecte… | ||||
| CVE-2026-42342US | — | — | ||
React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can c… | ||||
| CVE-2026-42211US | — | — | ||
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (… | ||||
| CVE-2026-34077US | — | — | ||
React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-… | ||||
| CVE-2026-45149US | high7.5 | — | ||
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding… | ||||
| CVE-2026-45736US | high7.5 | — | ||
ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArr… | ||||
| CVE-2026-42587US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit de… | ||||
| CVE-2026-42585US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling reques… | ||||
| CVE-2026-42584US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request… | ||||
| CVE-2026-42583US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to… | ||||
| CVE-2026-42581US | critical9.8 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a r… | ||||
| CVE-2026-42579US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints d… | ||||
| CVE-2026-43515US | — | Exploit | ||
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-… | ||||
| CVE-2026-43513US | — | — | ||
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1… | ||||
| CVE-2026-43512US | — | Exploit | ||
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1… | ||||
20 von 49 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01external
- Red Hat Security Advisory RHSA-2026:22380 vom 2026-06-18external
- Red Hat Security Advisory RHSA-2026:27171 vom 2026-06-19external
- Red Hat Security Advisory RHSA-2026:28964 vom 2026-07-02external
- Red Hat Security Advisory RHSA-2026:29197 vom 2026-06-24external
- Red Hat Security Advisory RHSA-2026:30076 vom 2026-06-25external
- Red Hat Security Advisory RHSA-2026:30650 vom 2026-06-28external
- Red Hat Security Advisory RHSA-2026:30651 vom 2026-06-28external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan