Atlassian Crowd vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20197
3. 20204
4. 20211

Known exploitedNewest addition to KEV first

• CVE-2019-11580

  Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or…

  Atlassian · Crowd

  ExploitedCritical9.8

Newest CVEs

• CVE-2020-36240

  The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read…

  Atlassian · Crowd

  Medium5.3
• CVE-2019-20902

  Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before…

  Atlassian · Crowd

  High7.5
• CVE-2019-20104

  The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of…

  Atlassian · Crowd

  High7.5
• CVE-2017-18107

  Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups…

  Atlassian · Crowd

  Medium6.5
• CVE-2019-15005

  The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results…

  Atlassian · Bitbucket Server

  Medium4.3
• CVE-2019-11580

  Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or…

  Atlassian · Crowd

  ExploitedCritical9.8
• CVE-2017-18110

  The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read…

  Atlassian · Crowd

  Medium6.5
• CVE-2017-18109

  The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to…

  Atlassian · Crowd

  Medium6.1
• CVE-2017-18108

  The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary…

  Atlassian · Crowd

  High7.2
• CVE-2017-18106

  The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in…

  Atlassian · Crowd

  High7.5