Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in multiple repositories in Atlassian FishEye...

Atlassian FishEye and Crucible Information Disclosure Vulnerabilities

Atlassian FishEye and Crucible are both products of the Australian company Atlassian. FishEye is an in-depth viewer of source code repositories, Crucible is a set of code review tools, and mostActiveCommitters.do resource is one of the development repositories. A security vulnerability exists in...

CVE-2017-9511

The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system...

Path traversal

The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system...

CVE-2017-9511

The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system...

CVE-2017-9510

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

Cross site scripting

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

CVE-2017-9512

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...

Design/Logic Flaw

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...

CVE-2017-9510

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

CVE-2017-9508

Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...

CVE-2017-9510

CVE-2017-9510 affects Atlassian FishEye (repository changelog resource). The vulnerability exists in FishEye before version 4.4.1 and allows remote attackers to inject arbitrary HTML or JavaScript via the start date and end date parameters, i.e., a cross-site scripting (XSS) flaw in the repositor...

CVE-2017-9510

The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...

CVE-2017-9512

The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...

PT-2017-18981 · Atlassian · Fisheye/Crucible

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.1 Description: The issue allows anonymous remote attackers to access sensitive information, such as email addresses of committers, due to a lack of permission checks in the...

Various XSS through a repository or review filename - CVE-2017-9508

Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...

Atlassian FishEye 2.5.8 / 2.6.8 / 2.7.12 XML Parsing Vulnerability

According to its self-reported version, the version of Atlassian FishEye running on the remote host is potentially affected by an XML parsing vulnerability. This vulnerability may allow an unauthenticated, remote attacker to perform a denial of service attack against FishEye. This vulnerability m...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via 1 snippets in a user comment, which is not properly handled in a Confluence page, or 2 the user profile display name,...

Atlassian FishEye Detection

Atlassian FishEye, a web interface for version control systems such as Subversion, Git, and Perforce, is running on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid50449; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate",...

Atlassian FishEye Code Metrics Report Plugin XSS

The version of Atlassian FishEye running on the remote host has a cross-site scripting vulnerability. The Code Metrics Report Plugin does not properly sanitize user input. A remote attacker could exploit this by tricking a user into making a maliciously crafted request, resulting in the execution...