CVE-2017-18041

An XSS vulnerability exists in Atlassian Bamboo before 6.2.0 in the viewDeploymentVersionJiraIssuesDialog resource, allowing remote attackers to inject arbitrary HTML/JavaScript via the release name. Affected: Bamboo

CVE-2017-18084

CVE-2017-18084 affects Atlassian Confluence Server

CVE-2017-18080

Atlassian Bamboo contains a CSRF vulnerability in the saveConfigureSecurity resource, affecting versions before 6.3.1. The issue allows remote attackers to modify security settings. Remediation: upgrade to Bamboo 6.3.1 or later (no other mitigations detailed in the provided docs).

CVE-2017-18081

Affected product: Atlassian Bamboo (signupUser resource). Vulnerable in versions before 6.3.1 due to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/JavaScript via the csrf token cookie value. Impact is the ability to execute script in a victim’s browser, p...

CVE-2017-18040

The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a release...

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

CVE-2017-18086

Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the issuesURL parameter...

CVE-2017-18034

Atlassian FishEye and Crucible suffer a cross-site scripting (XSS) vulnerability in the source browse resource prior to versions 4.5.1 and 4.6.0. A remote attacker with write access to an indexed repository can inject arbitrary HTML/JavaScript by exploiting a specially crafted repository branch n...

CVE-2017-18037

The CVE covers a path traversal flaw in Atlassian Bitbucket Server’s git repository tag rest resource. The problem resides in the tag name handling, allowing remote attackers to read arbitrary files on the server. Affected versions are Bitbucket Server 3.7.0–before 4.14.11 (fixed in 4.14.11), 5.0...

Path traversal through the name of a git tag in the git repository tag rest resource - CVE-2017-18037

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 the fixed version for 4.14.x, from version 5.0.0 before 5.0.9 the fixed version for 5.0.x, from version 5.1.0 before 5.1.8 the fixed version for 5.1.x, from version 5.2.0 before 5.2.6 the fixed...

Path traversal through the name of a git tag in the git repository tag rest resource - CVE-2017-18037

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 the fixed version for 4.14.x, from version 5.0.0 before 5.0.9 the fixed version for 5.0.x, from version 5.1.0 before 5.1.8 the fixed version for 5.1.x, from version 5.2.0 before 5.2.6 the fixed...

XSS in various resources in the issuesURL parameter - CVE-2017-18086

Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the issuesURL parameter...

XSS in various resources in the issuesURL parameter - CVE-2017-18086

Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the issuesURL parameter...

Content spoofing in the attachment resource in the Firefox browser - CVE-2018-13389

The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml...

Content spoofing in the attachment resource in the Firefox browser - CVE-2018-13389

The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml...

XSS in the viewdefaultdecorator resource through the key parameter - CVE-2017-18085

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...

XSS in the viewdefaultdecorator resource through the key parameter - CVE-2017-18085

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...

Argument injection in the download commit resource through the at parameter - CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.3 and from version 5.4.0 before version 5.4.1 allows remote attackers to write files to disk potentially allowing them...

XSS in the usermacros resource through the description of a macro - CVE-2017-18084

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro. Acknowledgements Atlassian would like to credit Veit Hailperin @fenceposterro...

XSS in the usermacros resource through the description of a macro - CVE-2017-18084

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the description of a macro. Acknowledgements Atlassian would like to credit Veit Hailperin @fenceposterro...