583 matches found
CVE-2017-9512
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...
CVE-2017-9508
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
CVE-2017-9512
CVE-2017-9512 affects Atlassian FishEye and Crucible prior to version 4.4.1. The vulnerability is an information disclosure in the mostActiveCommitters.do resource due to missing permission checks, allowing anonymous remote access to sensitive data such as committers’ email addresses. Connected s...
CVE-2017-9510
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...
CVE-2017-9508
CVE-2017-9508 affects Atlassian FishEye and Crucible versions before 4.4.1. A cross-site scripting (XSS) vulnerability exists where remote attackers can inject arbitrary HTML or JavaScript via the name of a repository or review file. The issue is exploitable remotely (network vector) with user in...
CVE-2017-9510
CVE-2017-9510 affects Atlassian FishEye (repository changelog resource). The vulnerability exists in FishEye before version 4.4.1 and allows remote attackers to inject arbitrary HTML or JavaScript via the start date and end date parameters, i.e., a cross-site scripting (XSS) flaw in the repositor...
CVE-2017-9512
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...
CVE-2017-9510
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...
CVE-2017-9512: Exposure of Sensitive Information to an Unauthorized Actor
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks...
PT-2017-18980 · Microsoft +1 · Windows +2
Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.1 Description: The issue allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating...
CVE-2017-9510: Improper Neutralization of Input During Web Page Generation
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the start date and end date parameters...
CVE-2017-9508: Improper Neutralization of Input During Web Page Generation
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
CVE-2017-9511: Improper Limitation of a Pathname to a Restricted Directory
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system...
PT-2017-18981 · Atlassian · Fisheye/Crucible
Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.4.1 Description: The issue allows anonymous remote attackers to access sensitive information, such as email addresses of committers, due to a lack of permission checks in the...
XSS in malicious repository file
A malicious file added to a repository will cause an XSS to file inside of FishEye...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...
Various XSS through a repository or review filename - CVE-2017-9508
Various resources in Atlassian FishEye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the name of a repository or review file...