According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.9 prior to 7.13.12, 7.19.0 prior to 7.19.3. It is, therefore, affected by a Denial of Service (DoS) attack vulnerability when relying on attacker controlled data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 9.6.0. It is, therefore, affected by multiple vulnerabilities:

- A issue in the underlying Spring framework which permits a authenticated attacker to perform a STOMP over WebSocket attack.

- A issue in the underlying Spring framework, which mis-handle file uploads and are vulnerable to a Denial of Service (DoS) if they rely on malicious data binding.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  - Vulnerability in the sfdc_preauth.jsp component. A remote, unauthenticated attacker can exploit this     vulnerability to execute arbitrary code. (CVE-2023-29382)

  - HTTP request smuggling vulnerability in the bundled Apache HTTP Server component. Exploitation of this     vulnerability can result in the bypass of access controls in the proxy server, proxying unintended URLs     to existing origin servers and cache poisoning. (CVE-2023-25690)

  - An SSRF vulnerability in the bundled Apache CXF component. (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including:

  - Vulnerability in the sfdc_preauth.jsp component. A remote, unauthenticated attacker can exploit this     vulnerability to execute arbitrary code. (CVE-2023-29382)

  - HTTP request smuggling vulnerability in the bundled Apache HTTP Server component. Exploitation of this     vulnerability can result in the bypass of access controls in the proxy server, proxying unintended URLs     to existing origin servers and cache poisoning. (CVE-2023-25690)

  - An server-side request forgery vulnerability in the bundled Apache CXF component. (CVE-2022-46364)

  - A cross-site scripting (XSS) vulnerability in the /h/autoSaveDraft function. A remote authenticated     attacker can executed arbitrary code in the context of another user. (CVE-2023-34192)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113713	7.19.0 < 7.19.3 Embedded Spring-Beans Denial Of Service	Web App Scanning	Component Vulnerability	3/9/2023	3/9/2023	medium
113712	Atlassian Confluence 7.13.9 < 7.13.12 Embedded Spring-Beans Denial Of Service	Web App Scanning	Component Vulnerability	3/9/2023	3/9/2023	medium
113718	Atlassian Jira < 9.6.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	3/9/2023	3/14/2023	medium
178616	Zimbra Collaboration Server 9.0.0 < 9.0.0 Patch 33 Multiple Vulnerabilities	Nessus	CGI abuses	7/20/2023	8/3/2023	critical
178617	Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 40 Multiple Vulnerabilities	Nessus	CGI abuses	7/20/2023	8/3/2023	critical

Detections

Analytics

Plugins Search

medium

medium

medium

critical

critical