554 matches found
Log forging vulnerability
It is possible to fake log entries in FishEye/Crucible logs, by sending specially crafted http requests containing a newline character. For example going to the url /changelog/asd%0AFake%20log%20entry will cause the following to be logged: code 2015-03-24 09:59:09,564 INFO qtp1610928748-315 fishe...
Crucible does not clear all Tokens when Browser is Closed
Problem Closing a browser ends the user session. When the user re-opens the browser and accesses Crucible, there is no login prompt and Crucible treats it like an authenticated user. Any page loads after the initial will result in the user being directed to the login page. Steps to Reproduce Have...
Crucible does not clear all Tokens when Browser is Closed
Problem Closing a browser ends the user session. When the user re-opens the browser and accesses Crucible, there is no login prompt and Crucible treats it like an authenticated user. Any page loads after the initial will result in the user being directed to the login page. Steps to Reproduce Have...
OGNL Double Evaluation Vulnerability
We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to be able to access the Crucible web interface. All versions of Crucible up to and including 3.6.1...
OGNL Double Evaluation Vulnerability
We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to be able to access the Crucible web interface. All versions of Crucible up to and including 3.6.1...
Atlassian Crucible 3.x < 3.0.4 / 3.1.7 / 3.2.5 / 3.3.4 / 3.4.4 Administrator Password Reset
According to its self-reported version, the installation of Atlassian Crucible running on the remote host is potentially affected by a flaw in which a remote, unauthenticated user is able to set the 'admin' user for Crucible to an arbitrary value. This can allow an attacker to gain administrative...
Use of the referrer header on the error page for Crucible can enable XSS attacks
If the referrer header is manipulated and an error condition is triggered, the user will be displayed the error page in FeCru, which includes the manipulated referrer value on the page as a link. The use of the referrer header value directly as the target of a hyperlink can result in the user...
Use of the referrer header on the error page for Crucible can enable XSS attacks
If the referrer header is manipulated and an error condition is triggered, the user will be displayed the error page in FeCru, which includes the manipulated referrer value on the page as a link. The use of the referrer header value directly as the target of a hyperlink can result in the user...
Default application files available for download via the application server.
see: https://jira.atlassian.com/browse/JRA-31187 e.g. https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/ and https://fisheye2.atlassian.com/s/1519/3/1.0//WEB-INF/web.xml . FishEye shouldn't write any user data to the WEB-INF directory. The only files which are viewable there, should be the sam...
Atlassian Crucible 2.5.8 / 2.6.8 / 2.7.12 XML Parsing Vulnerability
According to its self-reported version, the version of Atlassian Crucible running on the remote host is potentially affected by an XML parsing vulnerability. This vulnerability may allow an unauthenticated, remote attacker to perform a denial of service attack against Crucible. This vulnerability...
Atlassian Crucible Detection
Atlassian Crucible, a web-based code review application written in Java, is hosted on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59326; scriptversion"1.5"; scriptcvsdate"Date: 2019/11/25"; scriptnameenglish:"Atlassian Crucible Detection";...
CVE-2012-2926
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and...
CVE-2012-2926
CVE-2012-2926 covers multiple Atlassian products (JIRA <5.0.1; Confluence pre-3.5.16, 4.0.x <4.0.7, 4.1.x <4.1.10; FishEye/Crucible, Bamboo <3.3.4/3.4.x; Crowd <2.0.9, <2.1.2, <2.2.9, <2.3.7,
Atlassian JIRA FishEye and Crucible Plugins XML Parsing Unspecified Security Vulnerability
The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data. Exploiting this issue allows remote attackers to cause denial-of- service conditions or to disclose local sensitive files in the context of an affect...
Atlassian JIRA FishEye and Crucible Plugins XML Parsing Unspecified Security Vulnerability
The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data. Exploiting this issue allows remote attackers to cause denial-of- service conditions or to disclose local sensitive files in the context of an affect...
Atlassian JIRA FishEye 2.5.7 / Crucible 2.5.7 Plugins - XML Parsing Security
source: https://www.securityfocus.com/bid/53603/info The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data. Exploiting this issue allows remote attackers to cause denial-of-service conditions or to disclo...
Atlassian JIRA FishEye 2.5.7 Crucible 2.5.7 Plugins - XML Parsing Security
Atlassian JIRA FishEye 2.5.7 Crucible 2.5.7 Plugins - XML Parsing Security source: https://www.securityfocus.com/bid/53603/info The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data. Exploiting this issue...
Permission checking bug in Crucible Review Tooltips
We have identified and fixed a permission checking bug in the Crucible review tooltips. Affected versions are 2.4.6 to 2.5.6 This bug allows users to view metadata for a reviews that they do not have permission to view. This issue is reported in our security advisory on the following page:...
Permission checking bug in Crucible Review Tooltips
We have identified and fixed a permission checking bug in the Crucible review tooltips. Affected versions are 2.4.6 to 2.5.6 This bug allows users to view metadata for a reviews that they do not have permission to view. This issue is reported in our security advisory on the following page:...
XSS vulnerability in FishEye/Crucible Reviews List
We have identified and fixed a cross-site scripting XSS vulnerability in the FishEye/Crucible reviews list. Affected versions are FishEye/Crucible 2.2.8 to 2.5.2 inclusive. XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a FishEye/Crucible page. You can read...