CVE-2015-6576

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecified resource.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/134065/Bamboo-Java-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/536747/100/0/threadedThird Party Advisory, VDB Entry
https://confluence.atlassian.com/x/Hw7RLgVendor Advisory
https://jira.atlassian.com/browse/BAM-16439Issue Tracking, Vendor Advisory
http://packetstormsecurity.com/files/134065/Bamboo-Java-Code-Execution.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/536747/100/0/threadedThird Party Advisory, VDB Entry
https://confluence.atlassian.com/x/Hw7RLgVendor Advisory
https://jira.atlassian.com/browse/BAM-16439Issue Tracking, Vendor Advisory

Timeline

Published: Oct 3, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-65807.5Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause CVE-2015-65817.5Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Go CVE-2015-65826.8The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not veri CVE-2015-65834.3Google Chrome before 45.0.2454.85 does not display a location bar for a hosted app's window after navigation away from the installation site CVE-2015-65844.3Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary CVE-2015-65857.8hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type co CVE-2015-65867.5The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sen CVE-2015-65874.0The vlserver in OpenAFS before 1.6.13 allows remote authenticated users to cause a denial of service (out-of-bounds read and crash) via a cr CVE-2015-65886.1Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web s CVE-2015-65898.8Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 be CVE-2015-65915.5Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local u CVE-2015-65926.8Huawei UAP2105 before V300R012C00SPC160(BootRom) does not require authentication to the serial port or the VxWorks shell.