PT-2018-6632

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 6.2.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release, specifically affecting the...

PT-2018-6662

Name of the Vulnerable Software and Affected Versions: Atlassian Confluence Server versions prior to 6.4.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability through the contents of an uploaded file, specifically targetin...

CVE-2017-18037: Improper Limitation of a Pathname to a Restricted Directory

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 the fixed version for 4.14.x, from version 5.0.0 before 5.0.9 the fixed version for 5.0.x, from version 5.1.0 before 5.1.8 the fixed version for 5.1.x, from version 5.2.0 before 5.2.6 the fixed...

PT-2018-6634

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 6.3.1 Description: The issue allows remote attackers to modify user data, including passwords, via a Cross-site request forgery CSRF vulnerability. This is related to the update user administration resource...

CVE-2017-18042: Cross-Site Request Forgery (CSRF)

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

PT-2018-6627

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.5.1 and 4.6.0 Description: The issue concerns a missing permissions check in the /rest/review-coverage-chart/1.0/data//.json resource. This allows remote attackers without access to a...

CVE-2017-18080: Cross-Site Request Forgery (CSRF)

The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery CSRF vulnerability...

CVE-2017-18041: Improper Neutralization of Input During Web Page Generation

The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release...

CVE-2017-18082: Improper Neutralization of Input During Web Page Generation

The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a branch...

CVE-2017-18038: Improper Limitation of a Pathname to a Restricted Directory

The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal vulnerability through the default branch name...

CVE-2017-18081: Improper Neutralization of Input During Web Page Generation

The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the value of the csrf token cookie...

PT-2018-6659

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 6.3.1 Description: The issue allows remote attackers to modify security settings via a Cross-site request forgery CSRF vulnerability, specifically through the saveConfigureSecurity resource. Recommendations:...

PT-2018-6660

Name of the Vulnerable Software and Affected Versions: Atlassian Bamboo versions prior to 6.3.1 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. This is achieved through the value of the csrf token cookie in the...

CVE-2017-18040: Improper Neutralization of Input During Web Page Generation

The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release...

CVE-2017-16858

The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...

CVE-2017-16858

The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...

Design/Logic Flaw

The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...

CVE-2017-16858

The CVE-2017-16858 issue affects Atlassian Crowd’s crowd-application plugin (used by Google Apps) where versions 1.5.0–3.1.1 allow impersonation of a Crowd user in REST requests by authenticating to a directory bound to an application. In the described scenario, if Crowd is bound to directory 1 w...

CVE-2017-16858

The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...

CVE-2017-16858: Incorrect Authorization

The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...