CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2020-15162: Stored XSS in PrestaShop
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Affected products: PrestaShop PrestaShop
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
ATT&CK primary impact: T1059
ATT&CK secondary impact: T1185
ATT&CK techniques (all): T1059, T1185
CVE-2018-15961: 
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

Affected products: Adobe ColdFusion
CWE: Unrestricted file upload, CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1491.002
ATT&CK techniques (all): T1190, T1491, T1491.002, T1505.003
CVE-2020-5369: 
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability. An authenticated malicious user may exploit this vulnerability by using SyncIQ to gain unauthorized access to system management files.

Affected products: Dell Isilon OneFS
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068
CVE-2019-3780: Cloud Foundry Container Runtime Leaks IAAS Credentials
Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.

Affected products: Cloud Foundry Cloud Foundry Container Runtime (CFCR)
CWE: CWE-260: Password in Configuration File
CVSS: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
ATT&CK primary impact: T1552.001
ATT&CK secondary impact: T1068
ATT&CK techniques (all): T1068, T1552.001
CVE-2020-5264: Reflected XSS in security compromised page of PrestaShop
In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.

Affected products: PrestaShop PrestaShop
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
ATT&CK exploitation technique(s): T1204.001
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1557
ATT&CK techniques (all): T1059.007, T1204.001, T1557
CVE-2012-0754: 
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1105
ATT&CK techniques (all): T1105, T1204.002
CVE-2014-8439: 
Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

CWE: CWE-416 Use After Free
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1189
ATT&CK techniques (all): T1189
CVE-2018-11075: DSA-2018-152: RSA® Authentication Manager Multiple Vulnerabilities
RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application.

Affected products: RSA Authentication Manager
CWE: Reflected cross-site scripting vulnerability
CVSS: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1204.002
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1185
ATT&CK techniques (all): T1059.007, T1185, T1204.002
CVE-2024-57727: 
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1003, T1552.001, T1552.004
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1003, T1059, T1190, T1552.001, T1552.004
CVE-2022-37969: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 1809, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows 10 Version 21H1, Microsoft Windows Server 2022, Microsoft Windows 10 Version 20H2, Microsoft Windows 11 version 21H2, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows 7, Microsoft Windows 7 Service Pack 1, Microsoft Windows 8.1, Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2008  Service Pack 2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation)
CWE: Elevation of Privilege, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1068
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1068, T1078
CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.

Affected products: Drupal Drupal Core
CWE: Access Bypass
ATT&CK techniques (all): T1083, T1211
CVE-2019-1458: 
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.

Affected products: Microsoft Windows, Microsoft Windows Server
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1059, T1190
CVE-2018-17908: 
WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code.

Affected products: WebAccess Versions 8.3.2 and prior.
CWE: CWE-284 IMPROPER ACCESS CONTROL CWE-284
ATT&CK exploitation technique(s): T1685
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1685
CVE-2011-0096: 
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ATT&CK techniques (all): T1190
CVE-2009-3041: 
SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, which allows remote attackers to conduct unauthorized activities related to installation and backups, as exploited in the wild in August 2009.

ATT&CK techniques (all): T1190, T1203
CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability

Affected products: Microsoft Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Microsoft Exchange Server 2019 Cumulative Update 9, Microsoft Microsoft Exchange Server 2016 Cumulative Update 20, Microsoft Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Microsoft Exchange Server 2019 Cumulative Update 8
CWE: Remote Code Execution, CWE-918 Server-Side Request Forgery (SSRF)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1053.005
ATT&CK secondary impact: T1048.003, T1136, T1486
ATT&CK techniques (all): T1048.003, T1053.005, T1136, T1190, T1486
CVE-2018-8111: 
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8110, CVE-2018-8236.

Affected products: Microsoft Microsoft Edge
CWE: Remote Code Execution
ATT&CK exploitation technique(s): T1204.002, T1566
ATT&CK primary impact: T1499.004, T1574
ATT&CK secondary impact: T1005, T1136, T1485, T1565
ATT&CK techniques (all): T1005, T1136, T1204.002, T1485, T1499.004, T1565, T1566, T1574
CVE-2020-5281: LDAP connector injection in Perun
In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

Affected products: CESNET perun
CWE: CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059
CVE-2016-0167: 
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1608
CVE-2023-7024: 
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected products: Google Chrome
CWE: Heap buffer overflow, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1574
ATT&CK techniques (all): T1189, T1574
CVE-2018-10589: 
In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a path transversal vulnerability has been identified, which may allow an attacker to execute arbitrary code.

Affected products: Advantech WebAccess
CWE: CWE-22 PATH TRAVERSAL CWE-22
ATT&CK primary impact: T1202
ATT&CK techniques (all): T1202
CVE-2023-36845: Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series 

and SRX Series 

allows an unauthenticated, network-based attacker to remotely execute code.

Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.


This issue affects Juniper Networks Junos OS on EX Series


and 


SRX Series:



  *  All versions prior to 

20.4R3-S9;
  *  21.1 versions 21.1R1 and later;
  *  21.2 versions prior to 21.2R3-S7;
  *  21.3 versions prior to 21.3R3-S5;
  *  21.4 versions prior to 21.4R3-S5;
  *  22.1 versions 

prior to 

22.1R3-S4;
  *  22.2 versions 

prior to 

22.2R3-S2;
  *  22.3 versions 

prior to 

22.3R2-S2, 22.3R3-S1;
  *  22.4 versions 

prior to 

22.4R2-S1, 22.4R3;
  *  23.2 versions prior to 23.2R1-S1, 23.2R2.

Affected products: Juniper Networks Junos OS
CWE: CWE-473 PHP External Variable Modification
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1190
CVE-2024-4761: 
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Affected products: Google Chrome
CWE: Out of bounds write, CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1059
ATT&CK techniques (all): T1059
CVE-2012-1723: 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CWE: CWE-284 Improper Access Control
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1190
CVE-2019-1620: Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device. The vulnerability is due to incorrect permission settings in affected DCNM software. An attacker could exploit this vulnerability by uploading specially crafted data to the affected device. A successful exploit could allow the attacker to write arbitrary files on the filesystem and execute code with root privileges on the affected device.

Affected products: Cisco Cisco Data Center Network Manager
CWE: CWE-264
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK primary impact: T1105
ATT&CK secondary impact: T1059
ATT&CK techniques (all): T1059, T1105
CVE-2023-47565: Legacy VioStor NVR
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

QVR Firmware 5.0.0 and later

Affected products: QNAP Systems Inc. VioStor NVR
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1203
ATT&CK primary impact: T1496
ATT&CK secondary impact: T1498
ATT&CK techniques (all): T1203, T1496, T1498
CVE-2025-32709: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Affected products: Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-416: Use After Free
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1003, T1059, T1543, T1608.001
ATT&CK techniques (all): T1003, T1059, T1068, T1543, T1608.001
CVE-2018-5463: 
A structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA 4.1.0.3391 and earlier may allow code execution.

Affected products: ICS-CERT LCDS - Le&#195;&#163;o Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA
CWE: CWE-703 IMPROPER CHECK OR HANDLING OF EXCEPTIONAL CONDITIONS CWE-703
ATT&CK techniques (all): T1068
CVE-2022-43769: Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

Affected products: Hitachi Vantara Pentaho Business Analytics Server
CWE: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1203
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1203
CVE-2016-0165: 
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1608
CVE-2020-5231: Opencast users with ROLE_COURSE_ADMIN can create new users
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

Affected products: opencast opencast
CWE: CWE-285: Improper Authorization
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
ATT&CK primary impact: T1078.001
ATT&CK secondary impact: T1136
ATT&CK techniques (all): T1078.001, T1136
CVE-2020-11044: Double Free in FreeRDP
In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.

Affected products: FreeRDP FreeRDP
CWE: CWE-415: Double Free
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
ATT&CK primary impact: T1499.004
ATT&CK techniques (all): T1499.004
CVE-2014-7247: 
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

ATT&CK techniques (all): T1203, T1204.002
CVE-2023-22527: 
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action.

Most recent supported versions of Confluence Data Center and Server are not affected by this vulnerability as it was ultimately mitigated during regular version updates. However, Atlassian recommends that customers take care to install the latest version to protect their instances from non-critical vulnerabilities outlined in Atlassian’s January Security Bulletin.

Affected products: Atlassian Confluence Data Center, Atlassian Confluence Server, atlassian confluence_data_center, atlassian confluence_server
CWE: RCE (Remote Code Execution), CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1221
ATT&CK primary impact: T1496
ATT&CK techniques (all): T1221, T1496
CVE-2013-3163: 
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.

CWE: CWE-787 Out-of-bounds Write
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1203
CVE-2015-0071: 
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

CWE: CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
ATT&CK techniques (all): T1189, T1203, T1204.001