PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135)

slcyber.io | research | CVE-2022-26135 | #vulnerability-research | #exploitation | #jira | #ssrf | #atlassian
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# Abusing functionality to exploit a super SSRF in Jira Server (CVE-2022-26135) Get research alerts Share on social ) June 26, 2022 10 min read ### Table of Contents TOC Element Introduction The...
CVE
CVE-2022-26135
Published
Collected

Related coverage

research · slcyber.io
Advisory: Server Side Request Forgery in Jira Server (CVE-2022-26135)
# Advisory: Server Side Request Forgery in Jira Server (CVE-2022-26135) Get research alerts Share on social ) June 26, 2022 2 min read ### Table of Contents TOC Element Summary Impact Affected...
research · bugcrowd.com
Why We’re Letting 60,000 Bugcrowd Security Researchers Ethically Hack Us
Atlassian launches its first public bug bounty on Bugcrowd, adding JIRA and Confluence Cloud to existing Trello and StatusPage programs, with Bugcrowd triaging submissions across 14+ product lines.
vulnerability · slcyber.io
Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)
Post-auth SSRF in VMware Workspace ONE Access (CVE-2021-22056) chained to steal admin JWTs and achieve RCE.
vulnerability · slcyber.io
Turning bad SSRF to good SSRF: Websphere Portal (CVE-2021-27748)
Turning redirect-only SSRF into full-read SSRF in Websphere Portal (CVE-2021-27748) via open redirect chaining.
vulnerability · hackerone.com
HackerOne and JIRA integration update: more improvements, fewer clicks
HackerOne's JIRA integration gets three updates: the connector is now live on the Atlassian Marketplace, JIRA issues can be created in one click from a report, and two-way syncing is customizable per workflow.
vulnerability · blog.viettelcybersecurity.com
CVE-2022-0540 - Authentication bypass in Seraph
The author dissects CVE-2022-0540, the Jira auth bypass in Atlassian Seraph: role resolution derives from the request URI, and one semicolon defeats the mapping, exposing privileged actions.
Back