DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-18
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (93)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-21582US | — | — | ||
This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.
This BASM (Broke… | ||||
| CVE-2026-10050US | critical9.1 | — | ||
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did n… | ||||
| CVE-2026-69192US | — | — | ||
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as… | ||||
| CVE-2026-69152US | — | — | ||
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while con… | ||||
| CVE-2026-14682US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12,… | ||||
| CVE-2026-13506US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle… | ||||
| CVE-2026-12816US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-12803US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS bef… | ||||
| CVE-2026-12802US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bounc… | ||||
| CVE-2026-58060US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12,… | ||||
| CVE-2026-58059US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and B… | ||||
| CVE-2026-59642US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and… | ||||
| CVE-2026-59639US | high7.5 | — | ||
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bo… | ||||
| CVE-2026-67320US | high7.5 | — | ||
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototyp… | ||||
| CVE-2026-18446US | — | — | ||
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (… | ||||
| CVE-2026-59901US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipe… | ||||
| CVE-2026-55685US | high7.5 | — | ||
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the… | ||||
| CVE-2026-45623US | critical9.1 | — | ||
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap p… | ||||
| CVE-2026-14257US | — | — | ||
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but d… | ||||
| CVE-2026-56819US | — | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remo… | ||||
20 von 93 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:59153 vom 2026-10-02external
- Red Hat Security Advisory RHSA-2026:61691 vom 2026-08-31external
- Red Hat Security Advisory RHSA-2026:61783 vom 2026-09-01external
- Red Hat Security Advisory RHSA-2026:62260 vom 2026-09-02external
- Red Hat Security Advisory RHSA-2026:63142 vom 2026-09-03external
- Red Hat Security Advisory RHSA-2026:63307 vom 2026-10-02external
- Red Hat Security Advisory RHSA-2026:63355 vom 2026-09-04external
- Red Hat Security Advisory RHSA-2026:63373 vom 2026-09-04external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan