Bitbucket 6.1.1 Path Traversal to RCE

Impact In Bitbucket the four different user roles Bitbucket User, Project Creator, Admin and System Admin exist. An attacker with the permissions of the role Admin can abuse Bitbuckets Data Center Migration tool to drop an executable shell script in an arbitrary directory. This is caused by a...

CloudBees Jenkins Bitbucket Approve Plugin Trust Management Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based continuous integration tools from CloudBees. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Bitbucket Approve Plugin is used in one of the plugin used to support uploading...

Atlassian Bitbucket Data Center 5.13.x < 5.13.6 / 5.14.x < 5.14.4 / 5.15.x < 5.15.3 / 5.16.x < 5.16.3 / 6.0.x < 6.0.3 / 6.1.x < 6.1.2 Path Traversal Vulnerability (SA-2019-05-22)

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

Bitbucket sends email notifications to unlicensed users for pushed commits in a repository

h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...

Bitbucket sends email notifications to unlicensed users for pushed commits in a repository

h3. Issue Summary An unlicensed user will continue to receive email notifications for pushed commits for repositories that the user was watching and receiving notifications when active. h3. Steps to Reproduce User1 enables email repository email notifications to be sent immediately User1 watches...

Improper Restriction of XML External Entity Reference in ladon

Ladon since 0.6.1 since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059 is affected by: XML External Entity XXE. The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance:...

GHSA-VG35-VC9F-Q7X2 Improper Restriction of XML External Entity Reference in ladon

Ladon since 0.6.1 since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059 is affected by: XML External Entity XXE. The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance:...

Pushing a code with an unlicensed user is possible if it was once a licensed user and an SSH key is added to user's profile

h3. Issue Summary If once licensed users have an SSH key added to their profile, it is still possible for them to push the code once the license had been removed. However, it is not possible to pull the code. h3. Environment Every environment. h3. Steps to Reproduce Create a new user. Add any...

Pushing a code with an unlicensed user is possible if it was once a licensed user and an SSH key is added to user's profile

h3. Issue Summary If once licensed users have an SSH key added to their profile, it is still possible for them to push the code once the license had been removed. However, it is not possible to pull the code. h3. Environment Every environment. h3. Steps to Reproduce Create a new user. Add any...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

Path traversal

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 the fixed version for 5.13.x, from 5.14.0 before 5.14.4 fixed version for 5.14.x, from 5.15.0 before 5.15.3 fixed version for 5.15.x, from 5.16.0 before 5.16.3 fixed version for 5.16.x, from 6.0.0 before...

CVE-2019-3397

CVE-2019-3397 affects Atlassian Bitbucket Data Center licensed instances where vulnerable versions precede the fixed releases: 5.13.x before 5.13.6, 5.14.x before 5.14.4, 5.15.x before 5.15.3, 5.16.x before 5.16.3, 6.0.x before 6.0.3, and 6.1.x before 6.1.2. The issue allows an authenticated user...

Atlassian BitBucket Data Center Migration Tool Directory Traversal Vulnerability

Bitbucket Data Center is the on-premises Git repository management solution for larger enterprises that require high availability and performance at scale. It uses a cluster of Bitbucket server nodes and is designed in your own data center. A vulnerability was found in the Data Center’s migration...

Bitbucket Path Traversal / Remote Code Execution Vulnerability

Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that...

Bitbucket Data Center migration tool path traversal vulnerability

Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution manages and reviews code with features such as diff view, JIRA integration, and build integration.Bitbucket Data Center migration tool is a data center migration tool. A path traversal vulnerability...

Pacbot - Platform For Continuous Compliance Monitoring, Compliance Reporting And Security Automation For The Cloud

Policy as Code Bot PacBot is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to gauge policy...

jQuery 2.2.4 is vulnerable to prototype pollution

Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...

jQuery 2.2.4 is vulnerable to prototype pollution

Bitbucket Server comes with jQuery version 2.2.4. This version of jQuery is vulnerable to a security bug CVE-2019-11358, https://nvd.nist.gov/vuln/detail/CVE-2019-11358 which is only fixed in jQuery 3.4.0...