CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20240
https://notcve.org/view.php?id=CVE-2018-20240
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter. La funcionalidad de enlazador administrativo en Atlassian FishEye y Crucible, en versiones anteriores a la 4.7.0, permite que atacantes remotos inyecten HTML o JavaScript arbitrarios mediante una vulnerabilidad Cross-Site Scripting (XSS) en el parámetro href. • http://www.securityfocus.com/bid/107128 https://jira.atlassian.com/browse/CRUC-8381 https://jira.atlassian.com/browse/FE-7163 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-13399
https://notcve.org/view.php?id=CVE-2018-13399
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. El instalador de Microsoft Windows para Atlassian Fisheye y Crucible en versiones anteriores a la 4.6.1 permite que atacantes locales escalen privilegios debido a permisos débiles en el directorio de instalación. • https://jira.atlassian.com/browse/CRUC-8314 https://jira.atlassian.com/browse/FE-7105 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2017-18034
https://notcve.org/view.php?id=CVE-2017-18034
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch. El recurso de exploración de fuentes en Atlassian Fisheye y Crucible en versiones anterores 4.5.1 y 4.6.0 permite a los atacantes remotos que tienen acceso de escritura a un repositorio indexado inyectar HTML o JavaScript arbitrario a través de una vulnerabilidad de scripts de sitios cruzados (XSS) a través de un nombre de rama del repositorio especialmente elaborado cuando se intenta mostrar los archivos eliminados de la rama • https://jira.atlassian.com/browse/CRUC-8161 https://jira.atlassian.com/browse/FE-6994 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •