1256 matches found
CVE-2017-18038: Improper Limitation of a Pathname to a Restricted Directory
The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal vulnerability through the default branch name...
CVE-2017-18037: Improper Limitation of a Pathname to a Restricted Directory
The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 the fixed version for 4.14.x, from version 5.0.0 before 5.0.9 the fixed version for 5.0.x, from version 5.1.0 before 5.1.8 the fixed version for 5.1.x, from version 5.2.0 before 5.2.6 the fixed...
PT-2018-6629
Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Server versions 3.7.0 through 4.14.10 Atlassian Bitbucket Server versions 5.0.0 through 5.0.8 Atlassian Bitbucket Server versions 5.1.0 through 5.1.7 Atlassian Bitbucket Server versions 5.2.0 through 5.2.5 Atlassian...
PT-2018-6628
Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Server versions prior to 5.3.0 Description: The issue allows remote attackers to determine if a service they could not otherwise reach has open ports via a Server Side Request Forgery SSRF vulnerability. This is related to...
PT-2018-6630
Name of the Vulnerable Software and Affected Versions: Atlassian Bitbucket Server versions prior to 5.6.0 Description: The issue allows remote attackers to read the first line of arbitrary files via a path traversal vulnerability through the default branch name in the repository settings resource...
Atlassian auto-unapprove plugin security bypass vulnerability
Atlassian auto-unapprove plugin is a plugin with auto-unapprove function applied in Bitbucket by Atlassian Australia. A security vulnerability exists in Atlassian auto-unapprove plugin version 3.0.1. An attacker can exploit the vulnerability to bypass the plugin via a brute force attack...
REST API - Improved HTTP Authentication
h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is a simple resource that help administrators to perform operations that would take some time of their day to day activities in a couple seconds, instead of a couple minutes. I...
REST API - Improved HTTP Authentication
h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is a simple resource that help administrators to perform operations that would take some time of their day to day activities in a couple seconds, instead of a couple minutes. I...
CVE-2017-16857
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the...
Design/Logic Flaw
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the...
CVE-2017-16857
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the...
CVE-2017-16857
The CVE-2017-16857 entry concerns the Atlassian auto-unapprove plugin for Bitbucket. Affected component: the auto-unapprove plugin (not bundled with Bitbucket Server). Root cause: bypass of the plugin via minimal brute-force due to reliance on back-end asynchronous events, enabling an attacker to...
CVE-2017-16857: Concurrent Execution using Shared Resource with Improper Synchronization
It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows an attacker to merge any code into unsuspecting repositories. This affects all versions of the auto-unapprove plugin, however since the...
PT-2017-14602
Name of the Vulnerable Software and Affected Versions Bitbucket auto-unapprove plugin affected versions not specified Description The issue allows an attacker to bypass the auto-unapprove plugin in Bitbucket via minimal brute-force, exploiting the asynchronous events on the back-end. This enables...
Tinysvcmdns Multi-label DNS Heap Overflow Vulnerability(CVE-2017-12087)
Summary An exploitable heap overflow vulnerability exists in the tinysvcmdns library version 2016-07-18. A specially crafted packet can make the library overwrite an arbitrary amount of data on the heap with attacker controlled values. An attacker needs send a dns packet to trigger this...
Atlassian Bitbucket Server Directory Traversal Vulnerability
Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution is capable of managing and reviewing code with features such as diff view, JIRA integration and build integration. A directory traversal vulnerability exists in the pull requests resource in Atlassian...
Weblate: Open redirect in Signing in via Social Sites
Weak Authentication Leads to the Open redirection to Malicios Sites : Signing in via Facebook : + https://hosted.weblate.org/accounts/login/facebook/?next=///evil.com Signing in via Gmail : + https://hosted.weblate.org/accounts/login/google-oauth2/?next=///evil.com Signing in via Github: +...
Atlassian Bitbucket Detection (HTTP)
HTTP based detection of Atlassian Bitbucket. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Atlassian Bitbucket Directory Traversal Vulnerability (BSERV-8819)
Atlassian Bitbucket is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...