BA
Product
Bamboo
On CISA KEVExploited in the wild
28
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 14Medium 6Low 0
Watch
Add Bamboo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: 7.0.1 before 10.2.24; 11.0.0 before 12.1.12 |
| CVE-2022-26136 | 9.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps Affected: 7.2.0 before 7.2.10; 8.0.0 before 8.0.9; 8.1.0 before 8.1.8; 8.2.0 before 8.2.4 |
| CVE-2016-5229 | 9.8 | Aug 2 | Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via… Affected: through 5.11.3; 5.12.0; 5.12.1; 5.12.2 |
| CVE-2015-8360 | 9.8 | Feb 8 | An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to the JMS port Affected: 2.3.1; 2.4; 2.4.1; 2.4.2; 2.4.3; 2.5; +34 more |
| CVE-2014-9757 | 9.8 | Feb 8 | The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitrary Java code via… Affected: 2.4; 2.4.1; 2.4.2; 2.4.3; 2.5; 2.5.1; +34 more |
| CVE-2017-14589 | 9.6 | Dec 13 | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur Affected: before 6.1.6; 6.2.0 before 6.2.5 |
| CVE-2017-14590 | 9.1 | Dec 13 | Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters Affected: 2.7.0 before 6.1.6; 6.2.0 before 6.2.5 |
| CVE-2015-8361 | 9.1 | Feb 8 | Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain sensitive… Affected: 2.4; 2.4.1; 2.4.2; 2.4.3; 2.5; 2.5.1; +34 more |
| CVE-2012-2926 | 9.1 | May 22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo… Affected: before 3.3.4; 3.4 before 3.4.5 |
| CVE-2026-21571 | 8.8 | Apr 21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 9.6.2 before 9.6.25; 10.0.0 before 10.2.18; 11.0.0 before 12.1.6 |
| CVE-2026-21570 | 8.8 | Mar 17 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 9.6.1 before 9.6.24; 10.0.0 before 10.2.16; 11.0.0 before 12.1.3 |
| CVE-2023-22516 | 8.8 | Nov 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamboo Data Center and Server Affected: 8.1.0 before 9.2.7; 9.3.0 before 9.3.4 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: 7.2.0 before 7.2.10; 8.0.0 before 8.0.9; 8.1.0 before 8.1.8; 8.2.0 before 8.2.4 |
| CVE-2018-5224 | 8.8 | Mar 29 | Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters Affected: 2.7.0 before 6.3.3; 6.4.0 before 6.4.1 |
| CVE-2017-18080 | 8.8 | Feb 2 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF)… Affected: before 6.3.1 |
| CVE-2017-18042 | 8.8 | Feb 2 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery… Affected: before 6.3.1 |
| CVE-2017-9514 | 8.8 | Oct 12 | Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes could be loaded Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.1.0; +2 more |
| CVE-2015-6576 | 8.8 | Oct 3 | Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource Affected: 2.2 before 5.8.5; 5.9 before 5.9.7 |
| CVE-2017-8907 | 8.8 | Jun 14 | Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so Affected: 5.0; 5.0; 5.0; 5.0; 5.0; 5.0.1; +34 more |
| CVE-2026-21584 | 8.1 | Aug 18 | This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center Affected: 10.0.0 before 10.2.22; 11.0.0 before 12.1.10 |
| CVE-2024-21687 | 8.1 | Jul 16 | This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server Affected: 9.0.0 through 9.0.4; 9.1.0 through 9.1.3; 9.2.0 before 9.2.16; 9.3.0 through 9.3.6; 9.4.0 through 9.4.3; 9.5.0 through 9.5.4; +1 more |
| CVE-2024-21689 | 8.0 | Aug 20 | This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and… Affected: 9.1.0 before 9.2.17; 9.3.0 before 9.6.5 |
| CVE-2017-18081 | 6.1 | Feb 2 | The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability… Affected: before 6.3.1 |
| CVE-2017-18082 | 5.4 | Feb 2 | The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.2.3 |
| CVE-2017-18041 | 5.4 | Feb 2 | The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 6.2.0 |
| CVE-2017-18040 | 5.4 | Feb 2 | The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.2 |
| CVE-2021-26067 | 5.3 | Jan 28 | Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk and if certain files… Affected: before 7.2.2 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 6.10.2 |
Showing 28