Atlassian Fisheye vulnerabilities, page 3
54 vulnerabilities
Known vulnerabilities in Atlassian Fisheye, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2017-18035atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.CVSS4.3MediumEPSS0.79%RoutineCVE-2017-18034atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleThe source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.CVSS5.4MediumEPSS0.59%PrioritiseCVE-2017-16861atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleIt was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.CVSS9.8CriticalEPSS1.95%PrioritiseCVE-2017-14591atlassian · fisheye and crucible +2 moreatlassian fisheye and crucibleAtlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.CVSS9.3CriticalEPSS2.31%RoutineCVE-2017-14588atlassian · atlassian fisheye and crucible +2 moreatlassian atlassian fisheye and crucibleVarious resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.CVSS6.1MediumEPSS1.09%RoutineCVE-2017-14587atlassian · atlassian fisheye and crucible +2 moreatlassian atlassian fisheye and crucibleThe administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.CVSS5.4MediumEPSS0.85%PrioritiseCVE-2017-9511atlassian · atlassian fisheye and crucible +2 moreatlassian atlassian fisheye and crucibleThe MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.CVSS7.5HighEPSS3.24%PrioritiseCVE-2017-9512atlassian · atlassian fisheye and crucible +2 moreatlassian atlassian fisheye and crucibleThe mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.CVSS7.5HighEPSS1.97%RoutineCVE-2017-9510atlassian · atlassian fisheye +1 moreatlassian atlassian fisheyeThe repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.CVSS5.4MediumEPSS0.82%RoutineCVE-2017-9509atlassian · atlassian crucible +2 moreatlassian atlassian crucibleThe review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.CVSS5.4MediumEPSS0.82%RoutineCVE-2017-9508atlassian · atlassian fisheye and crucible +2 moreatlassian atlassian fisheye and crucibleVarious resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.CVSS5.4MediumEPSS0.83%RoutineCVE-2017-9507atlassian · atlassian crucible +2 moreatlassian atlassian crucibleThe review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.CVSS5.4MediumEPSS0.82%PrioritiseCVE-2012-2926atlassian · bamboo +6 moreatlassian bambooAtlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.CVSS9.1CriticalEPSS66.26%RoutineCVE-2011-4822atlassian · fisheyeatlassian fisheyeMultiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.CVSS4.3MediumEPSS1.53%