Cross site scripting

The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release...

CVE-2017-18082

The CVE-2017-18082 vulnerability affects Atlassian Bamboo’s plan configure branches resource. Versions prior to 6.2.3 are vulnerable to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML or JavaScript via the name of a branch. Mitigation: upgrade Bamboo to 6.2...

CVE-2017-18082

The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a branch...

CVE-2017-18083

CVE-2017-18083 affects Atlassian Confluence Server before 6.4.0, where the editinword resource is vulnerable to cross-site scripting (XSS) via the contents of an uploaded file. The issue enables an attacker to inject arbitrary HTML/JavaScript through the uploaded file contents, as described in mu...

CVE-2017-18084

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro...

CVE-2017-18086

CVE-2017-18086 affects Atlassian Confluence Server prior to 6.4.2, where the issuesURL parameter can be exploited to inject arbitrary HTML/JavaScript via a reflected XSS vulnerability. Public sources (NVD/Nessus/CNVD) describe the issue as a reflected XSS in multiple resources using the issuesURL...

CVE-2017-18041

The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release...

CVE-2017-18085

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...

CVE-2017-18039

The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the messagesThreshold parameter...

CVE-2017-18040

The vulnerability CVE-2017-18040 affects Atlassian Bamboo prior to version 6.2.0, in the viewDeploymentVersionCommits resource. It enables remote attackers to perform cross-site scripting by injecting arbitrary HTML/JavaScript via the name of a release. The issue is documented across multiple sou...

CVE-2017-18035

CVE-2017-18035 affects Atlassian Fisheye and Crucible. The issue is a missing permissions check in the REST endpoint /rest/review-coverage-chart/1.0/data//.json, which could let remote attackers who lack repository access determine the repository’s existence and view review-coverage statistics fo...

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in via a specially crafted repository bran...

CVE-2017-18039

CVE-2017-18039 is an XSS vulnerability in Atlassian Jira's IncomingMailServers messagesThreshold parameter, affecting Jira 6.2.1 up to versions before 7.4.4. The issue stems from an incomplete fix to CVE-2017-18039, enabling remote attackers to inject arbitrary HTML or JavaScript. Remediation is ...

CVE-2017-18041

An XSS vulnerability exists in Atlassian Bamboo before 6.2.0 in the viewDeploymentVersionJiraIssuesDialog resource, allowing remote attackers to inject arbitrary HTML/JavaScript via the release name. Affected: Bamboo

CVE-2017-18042

CVE-2017-18042 concerns Atlassian Bamboo prior to 6.3.1. The vulnerability is a CSRF in the update user administration resource, allowing remote attackers to modify user data, including passwords. Affected: Bamboo versions before 6.3.1. Root cause: CSRF in the update user admin endpoint. Impact: ...

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

CVE-2017-18080

The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery CSRF vulnerability...

CVE-2017-18081

The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the value of the csrf token cookie...

CVE-2017-18085

CVE-2017-18085 affects Atlassian Confluence Server prior to version 6.6.1, with a reflected XSS in the viewdefaultdecorator resource via the key parameter. Proof-of-impact details: arbitrary HTML/JavaScript can be injected. Affected products and versions are supported by multiple connected source...

CVE-2017-18083

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the contents of an uploaded file...