Total
51 CVE
CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
---|---|---|---|---|---|
CVE-2019-15008 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter. | |||||
CVE-2019-15009 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.0 MEDIUM | 4.3 MEDIUM |
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability. | |||||
CVE-2019-15007 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 4.8 MEDIUM |
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch. | |||||
CVE-2018-20239 | 1 Atlassian | 8 Application Links, Confluence Data Center, Confluence Server and 5 more | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0. | |||||
CVE-2018-13398 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.3 MEDIUM | 6.5 MEDIUM |
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability. | |||||
CVE-2018-13399 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.6 MEDIUM | 7.8 HIGH |
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. | |||||
CVE-2018-20241 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter. | |||||
CVE-2018-13392 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys. | |||||
CVE-2018-20240 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 4.8 MEDIUM |
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter. | |||||
CVE-2017-18094 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 4.8 MEDIUM |
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository. | |||||
CVE-2018-13388 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files. | |||||
CVE-2017-18035 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.0 MEDIUM | 4.3 MEDIUM |
The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it. | |||||
CVE-2017-18093 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 4.8 MEDIUM |
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository. | |||||
CVE-2017-18095 | 1 Atlassian | 1 Crucible | 2024-02-28 | 5.0 MEDIUM | 5.3 MEDIUM |
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability. | |||||
CVE-2017-18092 | 1 Atlassian | 1 Crucible | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of a comment on the snippet. | |||||
CVE-2017-18034 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch. | |||||
CVE-2017-16859 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 4.0 MEDIUM | 6.5 MEDIUM |
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter. | |||||
CVE-2017-16861 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability. | |||||
CVE-2018-5223 | 1 Atlassian | 2 Crucible, Fisheye | 2024-02-28 | 6.5 MEDIUM | 7.2 HIGH |
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability. | |||||
CVE-2017-18089 | 1 Atlassian | 1 Crucible | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review. |