CR
Product
Crowd
On CISA KEVExploited in the wildRansomware-linked
25
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 10Medium 8Low 0
Watch
Add Crowd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-11580 RansomwareIn wildKEV | 9.8 | Jun 3 | Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability Affected: 2.1.0 before unspecified; before 3.0.5; 3.1.0 before unspecified; before 3.1.6; 3.2.0 before unspecified; before 3.2.8; +4 more |
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: 2.11.0 before 6.3.7; 7.0.0 before 7.0.3; 7.1.0 before 7.1.7; 7.2.0 before 7.2.4 |
| CVE-2022-43782 | 9.8 | Nov 17 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints… Affected: 3.0.0 before 4.4.4; 5.0.0 before 5.0.3 |
| CVE-2022-26136 | 9.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps Affected: before 4.3.8; 4.4.0 before 4.4.2; 5.0.0 |
| CVE-2016-6496 | 9.8 | Dec 9 | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted… Affected: through 2.8.4; 2.9.0; 2.9.1 |
| CVE-2012-2926 | 9.1 | May 22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo… Affected: before 2.0.9; 2.1 before 2.1.2; 2.2.0 before 2.2.9; 2.3.0 before 2.3.7; 2.4.0 before 2.4.1 |
| CVE-2023-22521 | 8.8 | Nov 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server Affected: 3.4.0 before 5.1.6; 5.2.0 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: before 4.3.8; 4.4.0 before 4.4.2; 5.0.0 |
| CVE-2017-18105 | 8.1 | Mar 29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's… Affected: before 3.0.2; 3.1.0 before 3.1.1 |
| CVE-2018-20238 | 8.1 | Feb 13 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expired user session via… Affected: before 3.2.7; 3.3.0 before unspecified; before 3.3.4 |
| CVE-2026-21569 | 7.9 | Jan 28 | This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server Affected: 7.1.0 before 7.1.3 |
| CVE-2019-20902 | 7.5 | Oct 1 | Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP Affected: before 3.4.6; 3.5.0 before 3.5.1 |
| CVE-2019-20104 | 7.5 | Feb 6 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Service attack via an XML… Affected: before 3.2.11; 3.3.0 before 3.3.8; 3.4.0 before 3.4.7; 3.5.0 before 3.5.2; 3.6.0 before 3.6.2; 3.6.3 before 3.7.1; +1 more |
| CVE-2017-18106 | 7.5 | Mar 29 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different… Affected: before 2.9.1 |
| CVE-2017-18108 | 7.2 | Mar 29 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI… Affected: before 2.10.2 |
| CVE-2017-16858 | 6.8 | Jan 31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a… Affected: 1.5.0 before 3.1.2 |
| CVE-2017-18107 | 6.5 | Dec 17 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site… Affected: before 3.1.1 |
| CVE-2017-18110 | 6.5 | Mar 29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the… Affected: before 3.0.2; 3.1.0 |
| CVE-2017-18109 | 6.1 | Mar 29 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website… Affected: before 3.0.2; 3.1.0 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 3.4.3 |
| CVE-2020-36240 | 5.3 | Mar 1 | The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within… Affected: before 4.0.4; 4.1.0 before 4.1.2 |
| CVE-2016-10740 | 4.9 | Jan 29 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the… Affected: before 2.10.1 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 3.6.0 |
| CVE-2013-3926 | – | Jul 1 | Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, the vendor could not… Affected: 2.6.3 |
| CVE-2013-3925 | – | Jul 1 | Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet servers via a request… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.6.0; 2.6.1; +3 more |
Showing 25