CVE-2017-18087
Published Feb 15, 2018The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version 5.3.…
Vendor archive
atlassian CVEs
Beta · best-effort466 CVEs tagged to vendor atlassian — 47 Critical, 121 High, 294 Medium, 4 Low, 0 Unrated.
CVE-2017-18086
Published Feb 2, 2018Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability…
CVE-2017-18085
Published Feb 2, 2018The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XS…
CVE-2017-18084
Published Feb 2, 2018The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnera…
CVE-2017-18083
Published Feb 2, 2018The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnera…
CVE-2017-18082
Published Feb 2, 2018The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne…
CVE-2017-18081
Published Feb 2, 2018The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability thro…
CVE-2017-18080
Published Feb 2, 2018The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerabili…
CVE-2017-18042
Published Feb 2, 2018The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (…
CVE-2017-18041
Published Feb 2, 2018The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti…
CVE-2017-18040
Published Feb 2, 2018The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
CVE-2017-18039
Published Feb 2, 2018The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scriptin…
CVE-2017-18038
Published Feb 2, 2018The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal vulnerab…
CVE-2017-18037
Published Feb 2, 2018The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed ver…
CVE-2017-18036
Published Feb 2, 2018The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they could not otherwise reach has open ports v…
CVE-2017-18035
Published Feb 2, 2018The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this al…
CVE-2017-18034
Published Feb 2, 2018The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to injec…
CVE-2017-16861
Published Feb 1, 2018It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fis…
CVE-2017-16858
Published Jan 31, 2018The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crow…
CVE-2017-9513
Published Jan 29, 2018Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & receive notifications…
CVE-2017-14593
Published Jan 26, 2018Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in So…
CVE-2017-14592
Published Jan 26, 2018Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sour…
CVE-2017-16863
Published Jan 18, 2018The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through th…
CVE-2017-18033
Published Jan 18, 2018The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-sit…
CVE-2017-16865
Published Jan 17, 2018The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF). Wh…
Showing 376-400 of 466 CVEsPage 16 of 19