CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-18035
https://notcve.org/view.php?id=CVE-2017-18035
02 Feb 2018 — The /rest/review-coverage-chart/1.0/data/
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-16861 – Fisheye / Crucible Remote Code Execution
https://notcve.org/view.php?id=CVE-2017-16861
01 Feb 2018 — It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.... • http://www.securityfocus.com/bid/102971 •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-14591 – Fisheye / Crucible 4.4.x / 4.5.x Code Execution
https://notcve.org/view.php?id=CVE-2017-14591
29 Nov 2017 — Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software. Atlassian Fisheye y Crucible en versiones anteriores a la 4.3 y la versión 4.5.0 son vulnerables a una inyección de argumentos mediante nombres de archivo en repositorios Mercurial. Esto permite que los atacantes ejecuten código arbitrario en un sistema que ejecute el... • http://www.securityfocus.com/bid/102194 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-14587
https://notcve.org/view.php?id=CVE-2017-14587
11 Oct 2017 — The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter. El recurso de borrado de usuarios de administración en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.2 permite a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de Cross-Site Scripting (XSS) en el parámetro uname • http://www.securityfocus.com/bid/101266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-14588
https://notcve.org/view.php?id=CVE-2017-14588
11 Oct 2017 — Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter. Varios recursos en Atlassian Fisheye y Crucible en versiones anteriores a la 4.4.2 permiten a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de cross site scripting (XSS) en el parámetro de diálogo. • http://www.securityfocus.com/bid/101268 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-9511
https://notcve.org/view.php?id=CVE-2017-9511
24 Aug 2017 — The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system. La clase MultiPathResource en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permite que atacantes anónimos remotos lean archivos arbitrarios mediante una vulnerabilidad de salto de directorio cuando FishEye o Crucible se ejecutan en el si... • https://jira.atlassian.com/browse/CRUC-8049 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-9507
https://notcve.org/view.php?id=CVE-2017-9507
24 Aug 2017 — The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter. El recurso review dashboard en Atlassian Crucible desde la versión 4.1.0 hasta antes de la versión 4.4.1 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) en el parámetro review filter title. • https://jira.atlassian.com/browse/CRUC-8043 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2017-9508
https://notcve.org/view.php?id=CVE-2017-9508
24 Aug 2017 — Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file. Varios recursos en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permiten que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) mediante el nombre de un archivo de repositorio o de revisión • https://jira.atlassian.com/browse/CRUC-8044 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2017-9509
https://notcve.org/view.php?id=CVE-2017-9509
24 Aug 2017 — The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file. El recurso review file upload en Atlassian Crucible en versiones anteriores a la 4.4.1 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) mediante el conjunto de caracteres de un archivo previamente subid... • https://jira.atlassian.com/browse/CRUC-8046 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2017-9512
https://notcve.org/view.php?id=CVE-2017-9512
24 Aug 2017 — The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks. El recurso mostActiveCommitters.do en Atlassian FishEye y Crucible en versiones anteriores a la 4.4.1 permite que atacantes remotos accedan a información sensible, por ejemplo, las direcciones de email de los autores, ya que no cuenta con verificación de permisos • https://jira.atlassian.com/browse/CRUC-8053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •