Cross site scripting

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of quick filters...

CVE-2017-18100

CVE-2017-18100 affects Atlassian Jira’s agile wallboard gadget. The vulnerability allows cross-site scripting via the name of quick filters in Jira versions before 7.8.1, enabling remote injection of arbitrary HTML or JavaScript. Affected component: the agile wallboard gadget; root cause: XSS in ...

CVE-2017-18101

This CVE affects Atlassian Jira Server (including JIRA Core) prior to versions 7.6.5, 7.7.0 prior to 7.7.3, 7.8.0 prior to 7.8.3, and prior to 7.9.0. The issue permits remote attackers to perform import operations and to determine whether an internal service exists due to missing permission check...

CVE-2018-5227

Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the display url of a configured application link...

CVE-2017-18100

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of quick filters...

CVE-2017-18101

Various administrative external system import resources in Atlassian JIRA Server including JIRA Core before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if ...

CVE-2018-5227

Vulnerability summary: CVE-2018-5227 affects the Atlassian Application Links plugin. The XSS flaw resides in the display URL of a configured application link, exploitable by remote attackers with administration rights. This affects Atlassian Application Links versions prior to 5.4.4. Impact: Abil...

XSS in various types of nested wiki markup - CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

XSS in various types of nested wiki markup - CVE-2017-18102

The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup...

XSS in various types of nested wiki markup - CVE-2017-18102

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 currently...

XSS in various types of nested wiki markup - CVE-2017-18102

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 currently...

Missing authentication checks in various administrative system import resources - CVE-2017-18101

Various administrative external system import resources in Atlassian JIRA Server including JIRA Core before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if ...

Missing authentication checks in various administrative system import resources - CVE-2017-18101

Various administrative external system import resources in Atlassian JIRA Server including JIRA Core before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if ...

XSS in the agile wallboard gadget through quick filter names - CVE-2017-18100

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of quick filters. h3. Workaround Disable the gadget. - Navigate to Administration Add-ons Manage add-ons and se...

XSS in the agile wallboard gadget through quick filter names - CVE-2017-18100

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of quick filters. h3. Workaround Disable the gadget. - Navigate to Administration Add-ons Manage add-ons and se...

The bundled atlassian-http library had a content spoofing issue - CVE-2017-18103

The version of the bundled atlassian-http library was vulnerable to content-spoofing. See https://jira.atlassian.com/browse/HTTP-3 for more details...

The bundled atlassian-http library had a content spoofing issue - CVE-2017-18103

The version of the bundled atlassian-http library was vulnerable to content-spoofing. See https://jira.atlassian.com/browse/HTTP-3 for more details...

Atlassian Application Links OAuth status rest resource Cross-Site Request Forgery Vulnerability

Atlassian Application Links is a plugin from Atlassian Australia for creating buttons in Atlassian products to connect to other applications.OAuth status rest resource is one of the OAuth status resource packages. A cross-site request forgery vulnerability exists in the OAuth status rest resource...

Atlassian Fisheye / Crucible 4.5.2 Code Execution Vulnerability

Atlassian Fisheye and Crucible versions 4.5.0 through 4.5.2 suffer from a code execution vulnerability. This email refers to the advisory found at https://confluence.atlassian.com/x/aS5sO and https://confluence.atlassian.com/x/Zi5sO . CVE ID: CVE-2018-5223. Product: Fisheye and Crucible. Affected...

Atlassian Bamboo 6.x Code Execution Vulnerability

Atlassian Bamboo versions 2.7.0 through 6.3.2 and 6.4.0 suffer from a code execution vulnerability. This email refers to the advisory found at https://confluence.atlassian.com/x/PS9sO . CVE ID: CVE-2018-5224. Product: Bamboo. Affected Bamboo product versions: 2.7.0 = 2.7.0 but less than 6.3.3 the...