Atlassian Confluence Data Center vulnerabilities
45 known vulnerabilities affecting atlassian/confluence_data_center.
Total CVEs
45
CISA KEV
7
actively exploited
Public exploits
9
Exploited in wild
9
Severity breakdown
CRITICAL7HIGH24MEDIUM14
Vulnerabilities
Page 3 of 3
CVE-2023-22503P4MEDIUMCVSS 5.3fixed in 7.13.15≥ 7.14.0, < 7.19.7+2 more2023-05-01
CVE-2023-22503 [MEDIUM] CWE-200 CVE-2023-22503: Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to
Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labels in a private Confluence space. This occurs via an Information Disclosure vulnerability in the macro preview feature.
This vulnerability was reported by Rojan Rijal of the Tinder Security Engineering team.
Th
nvd
CVE-2020-4027P4MEDIUMCVSS 4.7≥ unspecified, < 7.4.5≥ 7.5.0, < unspecified+1 more2020-07-01
CVE-2020-4027 [MEDIUM] CWE-74 CVE-2020-4027: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with syste
Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.
nvd
CVE-2020-29444P4MEDIUMCVSS 5.4fixed in 7.11.02021-05-07
CVE-2020-29444 [MEDIUM] CWE-79 CVE-2020-29444: Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbi
Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters.
nvd
CVE-2020-36290P4MEDIUMCVSS 5.4fixed in 7.4.5≥ 7.5.0, < 7.6.3+6 more2022-07-26
CVE-2020-36290 [MEDIUM] CWE-79 CVE-2020-36290: The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 b
The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 before version 7.7.4 allows remote attackers with permission to edit a page or blog to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the page excerpt functionality.
nvd
CVE-2020-14175P4MEDIUMCVSS 5.4fixed in 7.4.2≥ 7.5.0, < 7.5.22020-07-24
CVE-2020-14175 [MEDIUM] CWE-79 CVE-2020-14175: Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject ar
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in user macro parameters. The affected versions are before version 7.4.2, and from version 7.5.0 before 7.5.2.
nvd
← Previous3 / 3