Atlassian Fisheye vulnerabilities, page 2
54 vulnerabilities
Known vulnerabilities in Atlassian Fisheye, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2020-4014atlassian · crucible +1 moreatlassian crucibleThe /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.CVSS4.3MediumEPSS0.77%RoutineCVE-2020-4013atlassian · crucible +1 moreatlassian crucibleThe review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.CVSS5.4MediumEPSS0.63%RoutineCVE-2019-15009atlassian · crucible +1 moreatlassian crucibleThe /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.CVSS4.3MediumEPSS0.73%RoutineCVE-2019-15008atlassian · crucible +1 moreatlassian crucibleThe /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.CVSS6.1MediumEPSS0.74%RoutineCVE-2019-15007atlassian · crucible +1 moreatlassian crucibleThe review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.CVSS4.8MediumEPSS0.60%RoutineCVE-2019-15005atlassian · bamboo +10 moreatlassian bambooThe Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.CVSS4.3MediumEPSS1.33%RoutineCVE-2018-20239atlassian · atlassian application links +8 moreatlassian atlassian application linksApplication Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.CVSS5.4MediumEPSS3.34%RoutineCVE-2018-20241atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.CVSS5.4MediumEPSS0.90%RoutineCVE-2018-20240atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.CVSS4.8MediumEPSS0.89%RoutineCVE-2018-13399atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.CVSS7.8HighEPSS0.26%RoutineCVE-2018-13398atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.CVSS6.5MediumEPSS0.53%RoutineCVE-2018-13392atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleSeveral resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.CVSS6.1MediumEPSS1.68%RoutineCVE-2018-13388atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.CVSS5.4MediumEPSS0.86%RoutineCVE-2017-16859atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.CVSS6.5MediumEPSS2.49%RoutineCVE-2018-5228atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.CVSS6.1MediumEPSS1.15%RoutineCVE-2018-5223atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleFisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.CVSS7.2HighEPSS2.08%RoutineCVE-2017-18094atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleVarious resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.CVSS4.8MediumEPSS0.60%RoutineCVE-2017-18093atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleVarious resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.CVSS4.8MediumEPSS0.84%RoutineCVE-2017-18091atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.CVSS4.8MediumEPSS0.84%RoutineCVE-2017-18090atlassian · fisheyeatlassian fisheyeVarious resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.CVSS6.1MediumEPSS0.85%