4896 matches found
CVE-2017-18095
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 the fixed version 4.5.x and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability...
CVE-2017-18092
The print snippet resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of a comment on the snippet...
CVE-2017-18093
This CVE affects Atlassian Fisheye and Crucible: before versions 4.4.3 (for 4.4.x line) and before 4.5.0 are vulnerable. The issue is a cross-site scripting (XSS) vulnerability in the location setting of a configured repository, exploitable by remote attackers who have permission to add or modify...
CVE-2017-18095
CVE-2017-18095 affects Atlassian Crucible prior to 4.5.1 and prior to 4.6.0. The vulnerability is an improper authorization that allows remote attackers to comment on snippets they should not access. A fix exists in the 4.5.x series (4.5.1+) and in 4.6.0+. Organizations using Crucible should upgr...
Cross site scripting
The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...
CVE-2017-18089
The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...
CVE-2017-18091
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...
CVE-2017-18090
Various resources in Atlassian Fisheye before version 4.5.1 the fixed version for 4.5.x and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a commit author...
CVE-2017-18089
The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...
Cross site scripting
Various resources in Atlassian Fisheye before version 4.5.1 the fixed version for 4.5.x and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a commit author...
CVE-2017-18091
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...
CVE-2017-18090
Various resources in Atlassian Fisheye before version 4.5.1 the fixed version for 4.5.x and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a commit author...
Cross site scripting
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...
CVE-2017-18090
CVE-2017-18090 affects Atlassian Fisheye prior to 4.5.1 (4.5.x line) and prior to 4.6.0, where an XSS flaw in the commit author name allows remote attackers to inject arbitrary HTML/JavaScript. The root cause is improper handling of author-name input, enabling script execution in victims’ session...
CVE-2017-18089
CVE-2017-18089 affects Atlassian Crucible, where the view review history resource in versions before 4.4.3 (and in 4.5.0) is vulnerable to a cross-site scripting (XSS) flaw. The issue allows remote attackers to inject arbitrary HTML or JavaScript via the invited reviewers for a review, due to ins...
CVE-2017-18091
CVE-2017-18091 affects Atlassian Fisheye and Crucible where the admin-backup progress action allows an attacker with administrative privileges to inject arbitrary HTML or JavaScript via the backup filename (XSS). The vulnerability exists in versions earlier than 4.4.3 (the fixed release for the 4...
CVE-2017-18091
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...
CVE-2017-18090
Various resources in Atlassian Fisheye before version 4.5.1 the fixed version for 4.5.x and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a commit author...
CVE-2017-18089
The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...
