Atlassian Crowd
13 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2020-36240 | unspecified – < 4.0.4 ; 4.1.0 – < unspecified ; unspecified – < 4.1.2 | The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote atta | MEDIUM 5.3 | 1.3 % | ||
| CVE-2019-20902 | unspecified – < 3.4.6 ; 3.5.0 – < unspecified ; unspecified – < 3.5.1 | Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and | HIGH 7.5 | 0.9 % | ||
| CVE-2019-20104 | unspecified – < 3.6.2 ; 3.7.0 – < unspecified ; unspecified – < 3.7.1 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perfor | HIGH 7.5 | 2.4 % | ||
| CVE-2017-18107 | unspecified – < 3.1.1 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and del | MEDIUM 6.5 | 0.4 % | ||
| CVE-2019-15005 | unspecified – < 3.6.0 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an | MEDIUM 4.3 | 1.3 % | ||
| CVE-2019-11580 | 2.1.0 – < unspecified ; unspecified – < 3.0.5 ; 3.1.0 – < unspecified ; … | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send un | CRITICAL 9.8 | 95 % | KEV | |
| CVE-2017-18110 | unspecified – < 3.0.2 ; 3.1.0 – < unspecified ; unspecified – < 3.1.1 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote | MEDIUM 6.5 | 1.2 % | ||
| CVE-2017-18109 | unspecified – < 3.0.2 ; 3.1.0 – < unspecified ; unspecified – < 3.1.1 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to | MEDIUM 6.1 | 1.1 % | ||
| CVE-2017-18108 | unspecified – < 2.10.2 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights t | HIGH 7.2 | 2.3 % | ||
| CVE-2017-18106 | unspecified – < 2.9.1 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for anothe | HIGH 7.5 | 1.2 % | ||
| CVE-2017-18105 | unspecified – < 3.0.2 ; 3.1.0 – < unspecified ; unspecified – < 3.1.1 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who | HIGH 8.1 | 1.4 % | ||
| CVE-2018-20238 | unspecified – < 3.2.7 ; 3.3.0 – < unspecified ; unspecified – < 3.3.4 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authent | HIGH 8.1 | 1.5 % | ||
| CVE-2017-16858 | from 1.5.0 before 3.1.2 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 al | MEDIUM 6.8 | 0.6 % |