deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-48865
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

tipc: fix kernel panic when enabling bearer

When enabling a bearer on a node, a kernel panic is observed:

[    4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]
...
[    4.520030] Call Trace:
[    4.520689]  <IRQ>
[    4.521236]  tipc_link_build_proto_msg+0x375/0x750 [tipc]
[    4.522654]  tipc_link_build_state_msg+0x48/0xc0 [tipc]
[    4.524034]  __tipc_node_link_up+0xd7/0x290 [tipc]
[    4.525292]  tipc_rcv+0x5da/0x730 [tipc]
[    4.526346]  ? __netif_receive_skb_core+0xb7/0xfc0
[    4.527601]  tipc_l2_rcv_msg+0x5e/0x90 [tipc]
[    4.528737]  __netif_receive_skb_list_core+0x20b/0x260
[    4.530068]  netif_receive_skb_list_internal+0x1bf/0x2e0
[    4.531450]  ? dev_gro_receive+0x4c2/0x680
[    4.532512]  napi_complete_done+0x6f/0x180
[    4.533570]  virtnet_poll+0x29c/0x42e [virtio_net]
...

The node in question is receiving activate messages in another
thread after changing bearer status to allow message sending/
receiving in current thread:

         thread 1           |              thread 2
         --------           |              --------
                            |
tipc_enable_bearer()        |
  test_and_set_bit_lock()   |
    tipc_bearer_xmit_skb()  |
                            | tipc_l2_rcv_msg()
                            |   tipc_rcv()
                            |     __tipc_node_link_up()
                            |       tipc_link_build_state_msg()
                            |         tipc_link_build_proto_msg()
                            |           tipc_mon_prep()
                            |           {
                            |             ...
                            |             // null-pointer dereference
                            |             u16 gen = mon->dom_gen;
                            |             ...
                            |           }
  // Not being executed yet |
  tipc_mon_create()         |
  {                         |
    ...                     |
    // allocate             |
    mon = kzalloc();        |
    ...                     |
  }                         |

Monitoring pointer in thread 2 is dereferenced before monitoring data
is allocated in thread 1. This causes kernel panic.

This commit fixes it by allocating the monitoring data before enabling
the bearer to receive messages.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2de76d37d4a6dca9b96ea51da24d4290e6cfa1a5; https://git.kernel.org/stable/c/be4977b847f5d5cedb64d50eaaf2218c3a55a3a3; https://git.kernel.org/stable/c/f4f59fdbc748805b08c13dae14c01f0518c77c94
CVE: CVE-2022-48866
Published: 2024-07-16
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug.
The root case is in missing validation check of actual number of endpoints.

Code should not blindly access usb_host_interface::endpoint array, since
it may contain less endpoints than code expects.

Fix it by adding missing validaion check and print an error if
number of endpoints do not match expected number
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab; https://git.kernel.org/stable/c/56185434e1e50acecee56d8f[PII_REDACTED]b87947; https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036
CVE: CVE-2024-6435
Published: 2024-07-16
Description: A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. For example, a malicious user with basic privileges could perform critical functions such as creating a user with elevated privileges and reading sensitive information in the “views” section.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1681.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1681.html
CVE: CVE-2022-45449
Published: 2024-07-16
Description: Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://security-advisory.acronis.com/advisories/SEC-5279; https://security-advisory.acronis.com/advisories/SEC-5279
CVE: CVE-2024-32861
Published: 2024-07-16
Description: Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.cisa.gov/news-events/ics-advisories/ICSA-24-191-05; https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories; https://www.cisa.gov/news-events/ics-advisories/ICSA-24-191-05
CVE: CVE-2024-6655
Published: 2024-07-16
Description: A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
CVSS Score: 7.0 (HIGH)
CWE: CWE-94
References: https://access.redhat.com/errata/RHSA-2024:6963; https://access.redhat.com/errata/RHSA-2024:9184; https://access.redhat.com/security/cve/CVE-2024-6655
CVE: CVE-2024-22442
Published: 2024-07-16
Description: The vulnerability could be remotely exploited to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04663en_us&docLocale=en_US; https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04663en_us&docLocale=en_US
CVE: CVE-2024-33180
Published: 2024-07-16
Description: Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/saveParentControlInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://palm-vertebra-fe9.notion.site/saveParentControlInfo_1-7c9695d0251945ae8006db705b9b80ac; https://palm-vertebra-fe9.notion.site/saveParentControlInfo_1-7c9695d0251945ae8006db705b9b80ac
CVE: CVE-2024-33182
Published: 2024-07-16
Description: Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/addWifiMacFilter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-121
References: https://palm-vertebra-fe9.notion.site/addWifiMacFilter_1-067fa6984f0d4933b88c63efd7486479; https://palm-vertebra-fe9.notion.site/addWifiMacFilter_1-067fa6984f0d4933b88c63efd7486479
CVE: CVE-2024-35338
Published: 2024-07-16
Description: Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://palm-vertebra-fe9.notion.site/hardcode_i29-e1ed38dde00145d9a6be1ad2b4581259; https://palm-vertebra-fe9.notion.site/hardcode_i29-e1ed38dde00145d9a6be1ad2b4581259
CVE: CVE-2024-40322
Published: 2024-07-16
Description: An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/KakeruJ/CVE/blob/main/JFinalCMS_SQL.md; https://github.com/KakeruJ/CVE/blob/main/JFinalCMS_SQL.md
CVE: CVE-2019-16638
Published: 2024-07-16
Description: An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://0x.mk/?p=239; https://0x.mk/?p=239
CVE: CVE-2019-16639
Published: 2024-07-16
Description: An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET commands and/or show admin passwords via the mode_url=exec&command= substring. This affects EG-2000SE EG_RGOS 11.9 B11P1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://0x.mk/?p=239; https://0x.mk/?p=239
CVE: CVE-2019-16640
Published: 2024-07-16
Description: An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not checked), which can allow an attacker to upload any file to the gateway. This affects EG-2000SE EG_RGOS 11.9 B11P1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://0x.mk/?p=239; https://0x.mk/?p=239
CVE: CVE-2019-16641
Published: 2024-07-16
Description: An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.php to login to any account, without providing its password. This affects EG-2000SE EG_RGOS 11.1(1)B1.
CVSS Score: 8.4 (HIGH)
CWE: CWE-121
References: https://0x.mk/?p=239; https://0x.mk/?p=239
CVE: CVE-2024-3232
Published: 2024-07-16
Description: A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232
CVSS Score: 7.6 (HIGH)
CWE: CWE-1236
References: https://www.tenable.com/security/tns-2024-04; https://www.tenable.com/security/tns-2024-04
CVE: CVE-2024-40626
Published: 2024-07-16
Description: Outline is an open source, collaborative document editor. A type confusion issue was found in ProseMirror’s rendering process that leads to a Stored Cross-Site Scripting (XSS) vulnerability in Outline. An authenticated user can create a document containing a malicious JavaScript payload. When other users view this document, the malicious Javascript can execute in the origin of Outline. Outline includes CSP rules to prevent third-party code execution, however in the case of self-hosting and having your file storage on the same domain as Outline a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions. This issue has been addressed in release version 0.77.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/outline/outline/security/advisories/GHSA-888c-mvg8-v6wh; https://github.com/outline/outline/security/advisories/GHSA-888c-mvg8-v6wh
CVE: CVE-2024-6089
Published: 2024-07-16
Description: An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to result in a major nonrecoverable fault. If exploited, a power cycle is required to recover the product.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1680.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1680.html
CVE: CVE-2024-6325
Published: 2024-07-16
Description: The v6.40 release of Rockwell Automation FactoryTalk® Policy Manager CVE-2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html  and  CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html  by implementing CIP security and did not update to the versions of the software CVE-2022-1161 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html  and  CVE-2022-1161. https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1585.html
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-276
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html
CVE: CVE-2024-6326
Published: 2024-07-16
Description: An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269, CWE-276
References: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html; https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1678.html
CVE: CVE-2023-31456
Published: 2024-07-16
Description: There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to internal and external resources by an authenticated user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://antidot.net/blog/; https://doc.fluidtopics.com/r/Fluid-Topics-Release-Notes/June-10th-2024; https://antidot.net/blog/
CVE: CVE-2024-33181
Published: 2024-07-16
Description: Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceMac parameter at ip/goform/addWifiMacFilter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://palm-vertebra-fe9.notion.site/addWifiMacFilter_2-0f7fab42d4254867b46fe92b25dc7c40; https://palm-vertebra-fe9.notion.site/addWifiMacFilter_2-0f7fab42d4254867b46fe92b25dc7c40
CVE: CVE-2024-39700
Published: 2024-07-16
Description: JupyterLab extension template is a  `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6; https://github.com/jupyterlab/extension-template/security/advisories/GHSA-45gq-v5wm-82wg; https://github.com/jupyterlab/extension-template/commit/035e78c1c65bcedee97c95bb683abe59c96bc4e6
CVE: CVE-2024-39908
Published: 2024-07-16
Description:  REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8; https://www.ruby-lang.org/en/news/2024/07/16/dos-rexml-cve-2024-39908; https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
CVE: CVE-2024-40425
Published: 2024-07-16
Description: File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to execute arbitrary code via the contorller/common.php component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://gist.github.com/J1rrY-learn/26524d4714a81cf2d64583069e96f765; https://gist.github.com/J1rrY-learn/26524d4714a81cf2d64583069e96f765
CVE: CVE-2024-39036
Published: 2024-07-16
Description: SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/seacms-net/CMS/issues/18; https://github.com/seacms-net/CMS/issues/18
CVE: CVE-2024-40129
Published: 2024-07-16
Description: Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-122
References: https://github.com/open5gs/open5gs/commit/2fbc445d32aa[PII_REDACTED]a9c055a199f90a1b01; https://github.com/open5gs/open5gs/issues/2585; https://github.com/open5gs/open5gs/commit/2fbc445d32aa[PII_REDACTED]a9c055a199f90a1b01
CVE: CVE-2024-40130
Published: 2024-07-16
Description: open5gs v2.6.4 is vulnerable to Buffer Overflow. via /lib/core/abts.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/open5gs/open5gs/commit/2f8ae91b0b9467f94f128090c88cae91bd73e008; https://github.com/open5gs/open5gs/issues/2577; https://github.com/open5gs/open5gs/commit/2f8ae91b0b9467f94f128090c88cae91bd73e008
CVE: CVE-2024-40392
Published: 2024-07-16
Description: SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/CveSecLook/cve/issues/46; https://github.com/CveSecLook/cve/issues/46
CVE: CVE-2024-40393
Published: 2024-07-16
Description: Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/CveSecLook/cve/issues/47; https://github.com/CveSecLook/cve/issues/47
CVE: CVE-2024-40394
Published: 2024-07-16
Description: Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/CveSecLook/cve/issues/48; https://github.com/CveSecLook/cve/issues/48
CVE: CVE-2024-40503
Published: 2024-07-16
Description: An issue in Tenda AX12 v.16.03.49.18_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-940
References: https://gist.github.com/Mivik/8927ad100a638756e1fe214dd5fca5f9; https://gist.github.com/Mivik/8927ad100a638756e1fe214dd5fca5f9
CVE: CVE-2024-40516
Published: 2024-07-16
Description: An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-940
References: https://gist.github.com/as-lky/2acc62c6283c7a1fe3af046b05091d15; https://gist.github.com/as-lky/2acc62c6283c7a1fe3af046b05091d15
CVE: CVE-2024-6492
Published: 2024-07-16
Description: Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Windows allows an attacker to intercept proxy credentials via a specially crafted website.
CVSS Score: 7.4 (HIGH)
CWE: CWE-522
References: https://devolutions.net/security/advisories/DEVO-2024-0012; https://devolutions.net/security/advisories/DEVO-2024-0012
CVE: CVE-2024-21686
Published: 2024-07-16
Description: This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server.

This Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires user interaction.

Atlassian recommends that Confluence Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions listed on this CVE

See the release notes (https://confluence.atlassian.com/doc/confluence-release-notes-327.html). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives).

This vulnerability was reported via our Bug Bounty program.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79, CWE-79
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/CONFSERVER-96134; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]
CVE: CVE-2024-40455
Published: 2024-07-16
Description: An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request.
CVSS Score: 2.7 (LOW)
CWE: CWE-352
References: https://gold-textbook-8ff.notion.site/ThinkSAAS-Arbitrary-folder-deletion-vulnerability-f992ed6124bc46ccaa8c2982274b17e2?pvs=25; https://gold-textbook-8ff.notion.site/ThinkSAAS-Arbitrary-folder-deletion-vulnerability-f992ed6124bc46ccaa8c2982274b17e2?pvs=25
CVE: CVE-2024-40456
Published: 2024-07-16
Description: ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.notion.so/ThinkSAAS-administrator-backend-SQL-injection-3a5c8c72fc374446892f8dc81ec94923?pvs=4; https://www.notion.so/ThinkSAAS-administrator-backend-SQL-injection-3a5c8c72fc374446892f8dc81ec94923?pvs=4
CVE: CVE-2024-40505
Published: 2024-07-16
Description: Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-35
References: https://coldwx.github.io/CVE-2024-40505.html; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10266; https://coldwx.github.io/CVE-2024-40505.html
CVE: CVE-2024-40515
Published: 2024-07-16
Description: An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48_cn allows a remote attacker to execute arbitrary code via the Routing functionality.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-940
References: https://gist.github.com/as-lky/410d6ae5c8ead88c2e0f5c641b2382ec; https://gist.github.com/as-lky/410d6ae5c8ead88c2e0f5c641b2382ec
CVE: CVE-2024-21687
Published: 2024-07-16
Description: This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data Center and Server.

This File Inclusion vulnerability, with a CVSS Score of 8.1, allows an authenticated attacker to get the application to display the contents of a local file, or execute a different files already stored locally on the server which has high impact to confidentiality, high impact to integrity, no impact to availability, and requires no user interaction.

Atlassian recommends that Bamboo Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions listed on this CVE

See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes[PII_REDACTED].html). You can download the latest version of Bamboo Data Center and Server from the download center (https://www.atlassian.com/software/bamboo/download-archives).

This vulnerability was reported via our Bug Bounty program.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]; https://jira.atlassian.com/browse/BAM-25822; https://confluence.atlassian.com/pages/viewpage.action?pageId=[PII_REDACTED]