Bug Bounty

**Name of the Vulnerable Software and Affected Versions** Bamboo Data Center and Server versions 9.1.0 through 9.6.0 **Description** The issue is related to insufficient input validation, allowing an authenticated attacker to execute arbitrary code, which has a high impact on confidentiality, integrity, and availability. This requires user interaction. Approximately 4,287 devices may be affected. **Recommendations** For Bamboo Data Center and Server 9.2: Upgrade to a release greater than or equal to 9.2.17 For Bamboo Data Center and Server 9.6: Upgrade to a release greater than or equal to 9.6.5 If you are unable to upgrade to the latest version, consider upgrading your instance to one of the specified supported fixed versions.

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo Data Center and Server versions 9.0.0 through 9.6.0 Description: The issue is related to a File Inclusion vulnerability that allows an authenticated attacker to display the contents of a local file or execute different files already stored locally on the server. This has a high impact on confidentiality and integrity but no impact on availability, and it requires no user interaction. Recommendations: For versions 9.6.0 to 9.6.3 LTS, upgrade to 9.6.4 LTS. For versions from 9.5.0 to 9.5.4, upgrade to 9.6.4 LTS. For versions from 9.4.0 to 9.4.3, upgrade to 9.6.4 LTS. For versions from 9.3.0 to 9.3.6, upgrade to 9.6.4 LTS. For versions from 9.2.0 to 9.2.15 LTS, upgrade to 9.6.4 LTS or 9.2.16 LTS. For versions from 9.1.0 to 9.1.3, upgrade to 9.6.4 LTS or 9.2.16 LTS. For versions from 9.0.0 to 9.0.4, upgrade to 9.6.4 LTS or 9.2.16 LTS. For any earlier versions, upgrade to 9.6.4 LTS or 9.2.16 LTS.

**Name of the Vulnerable Software and Affected Versions** Atlassian Assets Discovery (affected versions not specified) **Description** This issue allows an attacker to perform privileged Remote Code Execution (RCE) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application and the Assets Discovery agent. It is related to insufficient authentication data verification. Exploitation may allow a remote attacker to execute arbitrary code by spoofing the application server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.