CVE-2018-20234

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain...

CVE-2018-20235

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue t...

CVE-2018-20234

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain...

Design/Logic Flaw

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue t...

CVE-2018-20234

There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain...

CVE-2018-20235

There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue t...

CVE-2018-20235

CVE-2018-20235 affects Atlassian SourceTree for Windows via an argument injection vulnerability in the Mercurial repository handling (filenames) that allows a remote attacker with commit access to a linked Mercurial repo to execute code on the system. Affected versions are SourceTree for Windows ...

CVE-2018-20234

CVE-2018-20234 affects Atlassian Sourcetree for macOS (versions before 3.1.1). The vulnerability is an argument injection in the Mercurial repository component via filenames, which an attacker with commit access to a linked Mercurial repo can exploit to gain code execution on the system. The conn...

Atlassian JIRA < 7.6.2 Cross-Site Request Forgery

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site request forgery in the IncomingMailServers resource. A remote attacker can exploit this by tricking a user into visiting a specially crafted web...

Atlassian JIRA < 7.6.5 / 7.7.x < 7.7.3 / 7.8.x < 7.8.3 Limited Authentication Bypass

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an authentication bypass on certain administrative resources, which could allow an attacker to run import operations or reveal sensitive information...

Atlassian JIRA < 7.6.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by multiple vulnerabilities: - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An...

Atlassian JIRA < 7.6.7 / 7.7.x < 7.10.1 Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in EditIssue.jspa. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted...

Atlassian JIRA < 7.2.12 / 7.3.x < 7.6.1 Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in the jqlQuery query parameter of the printable searchrequest issue resource. An unauthenticated, remote attacker can...

Atlassian JIRA < 7.5.3 Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in the PieChart Gadget. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially...

Atlassian JIRA < 7.6.7 / 7.7.x < 7.11.0 Information Disclosure

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by an information disclosure vulnerability due to webhook events being sent improperly due to issues in the related JQL filter. %NASLMINLEVEL 70300 C Tenable Netwo...

Atlassian Fisheye and Crucible Cross-Site Scripting Vulnerabilities (CNVD-2019-04923)

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in the administrative linker feature in Atlassian Fisheye...

Atlassian Fisheye and Crucible cross-site scripting vulnerabilities (CNVD-2019-04924)

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in Atlassian Fisheye and Crucible versions prior to 4.7.0...

CVE-2018-20241

The CVE-2018-20241 entry describes a cross-site scripting (XSS) vulnerability in Atlassian Fisheye and Crucible. The issue affects the Edit upload resource for a review and is exploitable via the wbuser parameter, allowing remote attackers to inject arbitrary HTML or JavaScript. Affected products...

CVE-2018-20240

The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the href parameter...

CVE-2018-20241

The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the wbuser parameter...