Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
AtlassianCrucible

16 matches found

CVE
CVE•added 2018/03/29 1:29 p.m.•47 views

CVE-2018-5223

Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a...

7.2CVSS7AI score0.00958EPSS
CVE
CVE•added 2018/02/02 2:29 p.m.•46 views

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics ...

4.3CVSS4.6AI score0.00112EPSS
CVE
CVE•added 2018/02/02 2:29 p.m.•43 views

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository bran...

5.4CVSS5.3AI score0.0014EPSS
CVE
CVE•added 2018/02/16 6:29 p.m.•42 views

CVE-2017-18091

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a bac...

4.8CVSS4.9AI score0.00177EPSS
CVE
CVE•added 2018/02/01 4:29 a.m.•41 views

CVE-2017-16861

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is a...

9.8CVSS9.4AI score0.00585EPSS
CVE
CVE•added 2018/03/22 1:29 p.m.•41 views

CVE-2017-18094

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured ...

4.8CVSS5AI score0.00148EPSS
CVE
CVE•added 2018/06/28 2:29 p.m.•40 views

CVE-2017-16859

The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parame...

6.5CVSS6.5AI score0.01427EPSS
CVE
CVE•added 2018/07/10 1:29 p.m.•40 views

CVE-2018-13388

The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.

5.4CVSS5.3AI score0.00167EPSS
CVE
CVE•added 2018/02/16 6:29 p.m.•39 views

CVE-2017-18089

The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review.

5.4CVSS5.3AI score0.0018EPSS
CVE
CVE•added 2018/02/19 2:29 p.m.•38 views

CVE-2017-18092

The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of a comment on the snippet.

5.4CVSS5.3AI score0.0018EPSS
CVE
CVE•added 2018/02/19 2:29 p.m.•38 views

CVE-2017-18093

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location...

4.8CVSS5AI score0.00177EPSS
CVE
CVE•added 2018/09/18 2:29 p.m.•38 views

CVE-2018-13398

The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

6.5CVSS6.5AI score0.00136EPSS
CVE
CVE•added 2018/02/19 2:29 p.m.•35 views

CVE-2017-18095

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.

5.3CVSS5.4AI score0.00206EPSS
CVE
CVE•added 2018/10/16 1:29 p.m.•35 views

CVE-2018-13399

The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.

7.8CVSS7.6AI score0.00023EPSS
CVE
CVE•added 2018/08/13 1:29 p.m.•34 views

CVE-2018-13392

Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.

6.1CVSS6AI score0.00395EPSS
CVE
CVE•added 2018/04/24 12:29 p.m.•34 views

CVE-2018-5228

The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

6.1CVSS5.9AI score0.00264EPSS