Skip to content
OpenAdvisories
High WID-SEC-2026-1229 27 CVEs

Atlassian Bamboo, Bitbucket, Confluence, Jira: Mehrere Schwachstellen

Published Apr 21, 2026 · Updated Aug 2, 2026 · Revision 7 · de-DE

Vendor: Atlassian Vendor: IBM Vendor: Oracle Vendor: Red Hat Product: App Connect Enterprise Product: Bamboo Product: Bitbucket Product: Confluence Product: Enterprise Linux Product: Jira Product: Linux Product: openshift Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.
Bitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.
Confluence ist eine kommerzielle Wiki-Software.
Jira ist eine Webanwendung zur Softwareentwicklung.

Vulnerabilities 27

  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm
  • Critical 9.4
    CVE-2021-31597

    Improper Certificate Validation in xmlhttprequest-ssl

    The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other wor…

    js-jquery xmlhttprequest-ssl node-xmlhttprequest-ssl Ubuntu Azure Linux npm
  • Critical 9.4
    CVE-2026-21571

    This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.…

    Atlassian Bamboo Data Center
  • Critical 9.2
    CVE-2026-25547

    Uncontrolled Resource Consumption in @isaacs/brace-expansion

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern con…

    isaacs brace-expansion renovate lerna Debian Ubuntu Wolfi npm
  • High 8.8
    CVE-2025-48734 Public exploit

    Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

    Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

    Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  • High 8.8
    CVE-2026-23950

    node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

    node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesyst…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-29063

    Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

    Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been pa…

    immutable-js immutable-js katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-33871 Public exploit

    Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serve…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.3
    CVE-2022-1471 Public exploit EPSS 100%

    Remote Code execution in SnakeYAML

    SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…

    SnakeYaml SnakeYaml management-api-for-apache-cassandra-5.0 cassandra-reaper Debian Ubuntu Wolfi Maven
  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-24842

    node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicio…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Alpine Wolfi npm
  • High 8.2
    CVE-2026-31802 Public exploit

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file over…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.0
    CVE-2026-22029

    React Router vulnerable to XSS via Open Redirects

    React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unsta…

    remix-run react-router @remix-run/router react-router npm
  • High 7.5
    CVE-2021-0341

    Square OkHttp can accept the wrong certificate

    In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction…

    com.squareup.okhttp3:okhttp Android Maven
  • High 7.5
    CVE-2023-1370

    Stack exhaustion in json-smart leads to denial of service when parsing malformed JSON

    [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any lim…

    json-smart json-smart druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2024-29371

    jose4j is vulnerable to DoS via compressed JWE content

    In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memor…

    strimzi-kafka-operator-kafka-thirdparty-libs-cc strimzi-kafka-operator-tracing-agent strimzi-kafka-operator-kafka-agent strimzi-kafka-operator-kafka-init Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2025-66020

    Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

    Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can caus…

    open-circle valibot valibot npm
  • High 7.5
    CVE-2026-24880 Public exploit

    Apache Tomcat: Request smuggling via invalid chunk extension

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 throug…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2026-25639

    Axios affected by Denial of Service via __proto__ Key in mergeConfig

    Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can tr…

    axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-33870

    Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Vers…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-34487

    Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…

    Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-24734

    Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…

    Apache Software Foundation Apache Tomcat Apache Tomcat Native tomcat9 Debian Ubuntu Alpine Maven
  • High 7.3
    CVE-2024-45801

    Tampering by prototype polution in DOMPurify

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

    cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm
  • High 7.1
    CVE-2026-26960

    node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction

    node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary fil…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2023-3635 Public exploit

    Okio GzipSource unhandled exception Denial of Service

    GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

    thingsboard-tb-node thingsboard-tb-mqtt-transport trino trino-plugin-opensearch Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2022-25927 Public exploit

    ReDoS Vulnerability in ua-parser-js version

    Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

    ua-parser-js node-ua-parser-js node-ua-parser-js Debian Ubuntu npm
  • Medium 5.3
    CVE-2023-48631

    Denial of Service of regular expression in package @adobe/css-tools

    @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

    Adobe Not a product @adobe/css-tools npm

Revision history

  1. #7

    Neue Updates von Oracle Linux aufgenommen

  2. #6

    Neue Updates von Red Hat aufgenommen

  3. #5

    Neue Updates von Red Hat aufgenommen

  4. #4

    Neue Updates von IBM aufgenommen

  5. #3

    Neue Updates von Red Hat aufgenommen

  6. #2

    Neue Updates von Red Hat aufgenommen

  7. #1

    Initiale Fassung

References