Atlassian and Splunk this week announced patches for over 250 vulnerabilities across their products, including dozens of critical- and high-severity flaws.
On Tuesday, Atlassian published a Security Bulletin detailing 10 critical- and 162 high-severity issues in third-party dependencies, patched with fresh security updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira.
Because the vulnerable libraries are used across multiple products, many of the patched security defects affect multiple products. Overall, the fixes appear to address approximately 109 unique CVEs.
Successful exploitation of the bugs could allow attackers to mount remote code execution (RCE), denial-of-service (DoS), information theft, man-in-the-middle (MitM), authentication bypass, server-side request forgery (SSRF), and other types of attacks.
On Wednesday, Splunk announced fixes for at least 150 vulnerabilities across Splunk Enterprise, SOAR, Universal Forwarder, and their associated apps and plugins, including issues impacting third-party libraries.
Dozens of flaws are critical- and high-severity vulnerabilities, and some of them deserve special attention, Splunk says.
Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 were rolled out with fixes for 60 vulnerabilities, three of which have a ‘critical’ severity rating. At least two dozen security defects, including critical ones, were addressed in third-party packages in the product.
Critical bugs were also resolved with fresh versions of Splunk Apps and Add-ons (including AI Toolkit, Connect for Kafka, MCP Server app, and On-Call) and Splunk SOAR. Multiple defects in third-party dependencies in SOAR were also fixed.
Splunk rolled out Enterprise Security version 8.6.1 with patches for two high-severity issues, updated SOAR Connectors to resolve 17 medium- and low-severity flaws, and released a Universal Forwarder update that addresses three medium-severity weaknesses in OpenSSL.
Related: Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
Related: MLflow Vulnerability Exploited for Cloud Credential Theft
Related: AI-Driven Vulnerability Surge Breaks the Traditional Patching Model
Related: 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
