Atlassian Fisheye vulnerabilities

CVE-2017-18034 [MEDIUM] CWE-79 CVE-2017-18034: The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows a The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the b

CVE-2017-16861 [CRITICAL] CVE-2017-16861: It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of t

CVE-2017-14591 [CRITICAL] CWE-88 CVE-2017-14591: Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.

CVE-2017-14588 [MEDIUM] CWE-79 CVE-2017-14588: Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to i Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.

CVE-2017-14587 [MEDIUM] CWE-79 CVE-2017-14587: The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 all The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.

CVE-2017-9512 [HIGH] CWE-200 CVE-2017-9512: The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.

CVE-2017-9511 [HIGH] CWE-22 CVE-2017-9511: The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.

CVE-2017-9509 [MEDIUM] CWE-79 CVE-2017-9509: The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers t The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.

CVE-2017-9508 [MEDIUM] CWE-79 CVE-2017-9508: Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to i Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.

CVE-2017-9510 [MEDIUM] CWE-79 CVE-2017-9510: The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.

CVE-2017-9507 [MEDIUM] CWE-79 CVE-2017-9507: The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows r The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.

CVE-2012-2926 [CRITICAL] CVE-2012-2926: Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; Fish Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of

CVE-2011-4822 [MEDIUM] CWE-79 CVE-2011-4822: Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.