# \#vulnerability

**URL:** https://community.developer.atlassian.com/tag/vulnerability/1260.md

[Latest](https://community.developer.atlassian.com/latest.md) · [Categories](https://community.developer.atlassian.com/categories.md) · [Tags](https://community.developer.atlassian.com/tags.md)

---

## [Tough-cookie vulnerability (transitive dependency)](https://community.developer.atlassian.com/t/tough-cookie-vulnerability-transitive-dependency/91196)

<div class="topic-metadata">

**Author:** [@Bartlomiej1](https://community.developer.atlassian.com/u/Bartlomiej1)\
**Replies:** 0\
**Last updated:** [April 16, 2025, 7:48am UTC](https://community.developer.atlassian.com/t/tough-cookie-vulnerability-transitive-dependency/91196 "2025-04-16T07:48:02Z")

</div>

Hello, We are the vendor of two marketplace apps for Confluence Cloud based on the atlassian-connect-express library (latest 11.5.3 version). Our vulnerabilities scanners reported a security risk rated as high in the ou…

---

## [Vulnerable webpack versions referenced by forge npm packages](https://community.developer.atlassian.com/t/vulnerable-webpack-versions-referenced-by-forge-npm-packages/85595)

<div class="topic-metadata">

**Author:** [@jvillanuevabeyondtru](https://community.developer.atlassian.com/u/jvillanuevabeyondtru)\
**Replies:** 0\
**Last updated:** [October 25, 2024, 11:48pm UTC](https://community.developer.atlassian.com/t/vulnerable-webpack-versions-referenced-by-forge-npm-packages/85595 "2024-10-25T23:48:40Z")

</div>

While attempting to update my package dependency references, I recently discovered known vulnerable versions of webpack are being referenced by the ‘@forge/util’ package. Specifically, ‘@forge/api’ v4.0.0 — ‘@forge/u…

---

## [Forge cli npm package has dependencies to packages with high and critical vulnerability](https://community.developer.atlassian.com/t/forge-cli-npm-package-has-dependencies-to-packages-with-high-and-critical-vulnerability/74937)

<div class="topic-metadata">

**Author:** [@FabienLydoire](https://community.developer.atlassian.com/u/FabienLydoire)\
**Replies:** 1\
**Last updated:** [November 24, 2023, 9:21pm UTC](https://community.developer.atlassian.com/t/forge-cli-npm-package-has-dependencies-to-packages-with-high-and-critical-vulnerability/74937 "2023-11-24T21:21:23Z")

</div>

Hello ! When installing "@forge/cli": "^6.21.0", I get the audit report with high and critical vulnerabilities. I understand we are in a fast-paced environment, yet reading and audit report with critical and high vulne…

---

## [ASM Vulnerability Scan Status and Scanner Behavior](https://community.developer.atlassian.com/t/asm-vulnerability-scan-status-and-scanner-behavior/74296)

<div class="topic-metadata">

**Author:** [@MartinFischer](https://community.developer.atlassian.com/u/MartinFischer)\
**Replies:** 1\
**Last updated:** [November 2, 2023, 5:26am UTC](https://community.developer.atlassian.com/t/asm-vulnerability-scan-status-and-scanner-behavior/74296 "2023-11-02T05:26:31Z")

</div>

Hello, we are new to working with ASM and have encountered an issue related to a vulnerability in our application that was detected by EcoScanner. After collaborating with Atlassian support team, we created and deployed…

---

## [Atlassian-connect-express (ace) vulnerability in deprecated dependency](https://community.developer.atlassian.com/t/atlassian-connect-express-ace-vulnerability-in-deprecated-dependency/67599)

<div class="topic-metadata">

**Author:** [@Archer](https://community.developer.atlassian.com/u/Archer)\
**Replies:** 14\
**Last updated:** [July 21, 2023, 1:17pm UTC](https://community.developer.atlassian.com/t/atlassian-connect-express-ace-vulnerability-in-deprecated-dependency/67599 "2023-07-21T13:17:31Z")

</div>

Hello community, I bring to your attention the following vulnerability in ACE request’s dependency. This was reported to the Github Advisory Database about three days ago as well as Snyk’s vulnerabilities DB. It is …

---

## [Log4j upgrade update](https://community.developer.atlassian.com/t/log4j-upgrade-update/60455)

<div class="topic-metadata">

**Author:** [@RomanKolosovskiy](https://community.developer.atlassian.com/u/RomanKolosovskiy)\
**Replies:** 8\
**Last updated:** [October 5, 2022, 6:57am UTC](https://community.developer.atlassian.com/t/log4j-upgrade-update/60455 "2022-10-05T06:57:36Z")

</div>

Hello Community!! We wanted to post a quick update regarding the long-standing conversations about the Log4j version within Atlassian products. Atlassian has been devoted to ensuring that our customers’ data are secure …