CO
DevOps
Confluence
On CISA KEVExploited in the wildRansomware-linked
71
CVEs
10
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 11High 28Medium 29Low 0
Watch
Add Confluence to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-6283 | 6.1 | Jan 18 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileName parameter to… Affected: through 5.10.5 |
| CVE-2015-8398 | 6.1 | Apr 11 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to… Affected: through 5.8.16 |
| CVE-2020-36290 | 5.4 | Jul 26 | The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote… Affected: before 7.4.5; 7.5.0 before 7.6.3; 7.7.0 before 7.7.4 |
| CVE-2020-29444 | 5.4 | May 7 | Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin… Affected: before 7.11.0 |
| CVE-2020-14175 | 5.4 | Jul 24 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in… Affected: before 7.4.2; 7.5.0 before 7.5.2 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 6.15.2 |
| CVE-2017-18083 | 5.4 | Feb 2 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.4.0 |
| CVE-2016-4317 | 5.4 | Apr 10 | Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page Affected: through 5.9.10 |
| CVE-2023-22503 | 5.3 | May 1 | Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space Affected: before 7.13.15; 7.14.0 before 7.19.7; 7.20.0 before 8.2.0 |
| CVE-2020-29448 | 5.3 | Feb 22 | The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5.0 before 7.8.3… Affected: before 6.13.18; 6.14.0 before 7.4.6; 7.5.0 before 7.8.3 |
| CVE-2017-18084 | 4.8 | Feb 2 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 6.3.4 |
| CVE-2020-4027 | 4.7 | Jul 1 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations… Affected: before 7.4.5 |
| CVE-2018-13389 | 4.7 | Jul 10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a… Affected: before 6.6.1 |
| CVE-2020-29445 | 4.3 | May 7 | Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request… Affected: before 7.4.8; 7.5.0 before 7.11.0 |
| CVE-2021-26072 | 4.3 | Apr 1 | The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources… Affected: before 5.8.6 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 7.0.1 |
| CVE-2017-9505 | 4.3 | Jun 15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comments Affected: 4.3 before 6.2.1 |
| CVE-2015-8399 | 4.3 | Apr 11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2)… Affected: through 5.8.16 |
| CVE-2012-6342 | – | May 13 | Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administrators for requests… Affected: 3.4.6 |
| CVE-2012-2928 | – | May 22 | The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows… Affected: 4.1.9 |
| CVE-2005-3967 | – | Dec 3 | Cross-site scripting (XSS) vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary web script or HTML… Affected: 2.0.1_build_321 |