Atlassian Bamboo
12 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2021-26067 | unspecified – < 7.2.2 | Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home d | MEDIUM 5.3 | 1.1 % | ||
| CVE-2019-15005 | | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an | MEDIUM 4.3 | 1.3 % | ||
| CVE-2018-5224 | 2.7.1 – < unspecified ; unspecified – < 6.3.3 ; 6.4.0 – < unspecified ; … | Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argu | HIGH 8.8 | 2.7 % | ||
| CVE-2017-18082 | prior to 6.2.3 | The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript | MEDIUM 5.4 | 0.6 % | ||
| CVE-2017-18081 | prior to 6.3.1 | The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross | MEDIUM 6.1 | 0.8 % | ||
| CVE-2017-18080 | prior to 6.3.1 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross- | HIGH 8.8 | 0.5 % | ||
| CVE-2017-18042 | prior to 6.3.1 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passw | HIGH 8.8 | 0.7 % | ||
| CVE-2017-18041 | prior to 6.2.0 | The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML | MEDIUM 5.4 | 0.6 % | ||
| CVE-2017-18040 | prior to 6.2.0 | The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaS | MEDIUM 5.4 | 0.6 % | ||
| CVE-2017-14590 | from 2.7.0 before 6.1.6 (the fixed version for 6.1.x) ; from 6.2.0 before 6.2.5 | Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to cr | CRITICAL 9.1 | 2.4 % | ||
| CVE-2017-14589 | before 6.1.6 (the fixed version for 6.1.x) ; from 6.2.0 before 6.2.5 (the fixed version for 6.2.x) | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted a | CRITICAL 9.6 | 1.9 % | ||
| CVE-2017-9514 | from 6.0.0 before 6.0.5 ; from 6.1.0 before 6.1.4 ; from 6.2.0 before 6.2.1 | Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric | HIGH 8.8 | 1.0 % |