Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

548 matches found

NVD
NVD•added 2018/02/16 6:29 p.m.•15 views

CVE-2017-18089

The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...

5.4CVSS5.3AI score0.00654EPSS
SaveExploits0References2
Prion
Prion•added 2018/02/16 6:29 p.m.•16 views

Cross site scripting

The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...

3.5CVSS5.3AI score0.00654EPSS
SaveExploits0References2Affected Software1
CVE
CVE•added 2018/02/16 6:0 p.m.•58 views

CVE-2017-18091

CVE-2017-18091 affects Atlassian Fisheye and Crucible where the admin-backup progress action allows an attacker with administrative privileges to inject arbitrary HTML or JavaScript via the backup filename (XSS). The vulnerability exists in versions earlier than 4.4.3 (the fixed release for the 4...

4.8CVSS4.9AI score0.00857EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2018/02/16 6:0 p.m.•20 views

CVE-2017-18091

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 the fixed version for 4.4.x and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the filename of a backu...

5AI score0.00857EPSS
SaveExploits0References3
CVE
CVE•added 2018/02/16 6:0 p.m.•57 views

CVE-2017-18089

CVE-2017-18089 affects Atlassian Crucible, where the view review history resource in versions before 4.4.3 (and in 4.5.0) is vulnerable to a cross-site scripting (XSS) flaw. The issue allows remote attackers to inject arbitrary HTML or JavaScript via the invited reviewers for a review, due to ins...

5.4CVSS5.3AI score0.00654EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist•added 2018/02/16 6:0 p.m.•22 views

CVE-2017-18089

The view review history resource in Atlassian Crucible before version 4.4.3 the fixed version for 4.4.x and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the invited reviewers for a review...

5.3AI score0.00654EPSS
SaveExploits0References2
CNVD
CNVD•added 2018/02/08 12:0 a.m.•6 views

Atlassian Fisheye and Crucible Information Disclosure Vulnerability (CNVD-2018-05564)

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A security vulnerability exists in the /rest/review-coverage-chart/1.0/data/.json resourc...

4.3CVSS7.1AI score0.00788EPSS
SaveExploits0References1
CNVD
CNVD•added 2018/02/07 12:0 a.m.•7 views

Atlassian FishEye and Crucible Cross-Site Scripting Vulnerabilities (CNVD-2018-05475)

Atlassian FishEye and Crucible are both products of the Australian company Atlassian, FishEye is a suite of software for deep viewing of source code repositories and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in source browse resource in Atlassian FishEy...

5.4CVSS6.3AI score0.00586EPSS
SaveExploits0References1
OSV
OSV•added 2018/02/02 2:29 p.m.•4 views

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in via a specially crafted repository bran...

5.4CVSS5.4AI score0.00586EPSS
SaveExploits0References2
OSV
OSV•added 2018/02/02 2:29 p.m.•6 views

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

4.3CVSS5.8AI score0.00788EPSS
SaveExploits0References2
NVD
NVD•added 2018/02/02 2:29 p.m.•22 views

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

4.3CVSS4.7AI score0.00788EPSS
SaveExploits0References2
Prion
Prion•added 2018/02/02 2:29 p.m.•22 views

Cross site scripting

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in via a specially crafted repository bran...

3.5CVSS5.3AI score0.00586EPSS
SaveExploits0References2Affected Software2
NVD
NVD•added 2018/02/02 2:29 p.m.•20 views

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in via a specially crafted repository bran...

5.4CVSS5.4AI score0.00586EPSS
SaveExploits0References2
Prion
Prion•added 2018/02/02 2:29 p.m.•24 views

Design/Logic Flaw

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

4CVSS4.7AI score0.00788EPSS
SaveExploits0References2Affected Software2
CVE
CVE•added 2018/02/02 2:0 p.m.•61 views

CVE-2017-18034

Atlassian FishEye and Crucible suffer a cross-site scripting (XSS) vulnerability in the source browse resource prior to versions 4.5.1 and 4.6.0. A remote attacker with write access to an indexed repository can inject arbitrary HTML/JavaScript by exploiting a specially crafted repository branch n...

5.4CVSS5.3AI score0.00586EPSS
SaveExploits0References2Affected Software2
CVE
CVE•added 2018/02/02 2:0 p.m.•66 views

CVE-2017-18035

CVE-2017-18035 affects Atlassian Fisheye and Crucible. The issue is a missing permissions check in the REST endpoint /rest/review-coverage-chart/1.0/data//.json, which could let remote attackers who lack repository access determine the repository’s existence and view review-coverage statistics fo...

4.3CVSS4.6AI score0.00788EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist•added 2018/02/02 2:0 p.m.•25 views

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in via a specially crafted repository bran...

5.4AI score0.00586EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2018/02/02 2:0 p.m.•31 views

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

4.6AI score0.00788EPSS
SaveExploits0References2
Prion
Prion•added 2018/02/01 4:29 a.m.•17 views

Design/Logic Flaw

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is...

7.5CVSS9.4AI score0.01946EPSS
SaveExploits0References5Affected Software2
NVD
NVD•added 2018/02/01 4:29 a.m.•21 views

CVE-2017-16861

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is...

9.8CVSS9.5AI score0.01946EPSS
SaveExploits0References5
Rows per page
Query Builder