Author: Cyberthreat Blog

Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page.

Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name.

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application.

Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource.

Jive before 2016.3.1 has an open redirect from the external-link.jspa page.