CVE-2020-4017

The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability...

Information disclosure

The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability...

Authorization

The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability...

Information disclosure

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability...

Information disclosure

The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability...

Cross site request forgery (csrf)

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery CSRF vulnerability...

Cross site scripting

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the review objectives...

CVE-2020-4023

Atlassian Fisheye and Crucible are affected by CVE-2020-4023: the review coverage resource allows a cross-site scripting (XSS) via the committerFilter parameter in versions before 4.8.2. The vulnerability impacts the ability to inject arbitrary HTML/JavaScript. Affected versions:

CVE-2020-4023

The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the committerFilter parameter...

CVE-2020-4018

CVE-2020-4018 affects Atlassian Fisheye and Crucible prior to version 4.8.1. The issue is a CSRF vulnerability in the setup resources that allows remote attackers to complete the setup process. The vulnerability is documented across multiple sources (NVD/CNVD) with exploitation described as CSRF ...

CVE-2020-4018

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery CSRF vulnerability...

CVE-2020-4017

The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability...

CVE-2020-4017

The vulnerability CVE-2020-4017 affects Atlassian Fisheye and Crucible (crucible-jira-ril plugin) via the /rest/jira-ril/1.0/jira-rest/applinks resource. Versions before 4.8.1 allow remote attackers to disclose information about any configured Jira application links. The issue is an information d...

CVE-2020-4015

The CVE targets Atlassian Fisheye and Crucible before version 4.8.1, where the /json/fe/activeUserFinder.do resource suffers a security misconfiguration leading to information disclosure: remote attackers can view users’ email addresses. Affected component: the activeUserFinder endpoint in these ...

CVE-2020-4016

The CVE-2020-4016 issue affects Atlassian Fisheye and Crucible (crucible-jira-ril plugin). The vulnerable component is the /plugins/servlet/jira-blockers/ resource, and the root cause is an information-disclosure vulnerability that allows remote attackers to obtain the IDs of configured Jira appl...

CVE-2020-4015

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability...

CVE-2020-4016

The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability...

CVE-2020-4014

The CVE-2020-4014 vulnerability affects Atlassian Fisheye and Crucible before version 4.8.1. The issue resides in the /profile/deleteWatch.do resource, where improper authorization allows remote attackers to remove another user’s repository watching settings. Impact is limited to unauthorized mod...

CVE-2020-4014

The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability...

CVE-2020-4013

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting XSS vulnerability through the review objectives...