548 matches found
CVE-2017-9512
CVE-2017-9512 affects Atlassian FishEye and Crucible prior to version 4.4.1. The vulnerability is an information disclosure in the mostActiveCommitters.do resource due to missing permission checks, allowing anonymous remote access to sensitive data such as committers’ email addresses. Connected s...
CVE-2017-9509
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the charset of a previously uploaded file...
CVE-2017-9512
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...
CVE-2017-9507
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the review filter title parameter...
PT-2017-18980 · Microsoft +1 · Windows +2
Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.1 Description: The issue allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating...
PT-2017-18981 · Atlassian · Fisheye/Crucible
Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.1 Description: The issue allows anonymous remote attackers to access sensitive information, such as email addresses of committers, due to a lack of permission checks in the...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
XSS in review dashboard through a custom filter title - CVE-2017-9507
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the review filter title parameter...
XSS in review dashboard through a custom filter title - CVE-2017-9507
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the review filter title parameter...
Atlassian Crucible Server < 3.10.0 Multiple Vulnerabilities
Binary data 9782.prm...
Atlassian Crucible Server 3.9.x < 3.9.2 Multiple Vulnerabilities
Binary data 9781.prm...
Atlassian Crucible Server 3.10.x < 3.10.3 XSS
Binary data 9784.prm...
Atlassian Crucible Server 3.10.x < 3.10.2 Multiple Vulnerabilities
Binary data 9783.prm...
Atlassian Crucible Server < 4.0.0 Multiple Vulnerabilities
Binary data 9785.prm...
"Allowed review participants" isn't restricting the scope for groups
h3. Summary The "Allowed review participants" option in the project settings isn't restricting the scope for groups when searching for reviewers to be added to a review, therefore all the groups are listed, even the ones not included as allowed groups. h3. Environment Tested on Crucible 4.2.0 h3...
"Allowed review participants" isn't restricting the scope for groups
h3. Summary The "Allowed review participants" option in the project settings isn't restricting the scope for groups when searching for reviewers to be added to a review, therefore all the groups are listed, even the ones not included as allowed groups. h3. Environment Tested on Crucible 4.2.0 h3...