CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Atlassian » Fisheye » * * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-43958 307 2022-03-16 2022-03-22
7.5
 None Remote Low Not required Partial Partial Partial
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
2 CVE-2021-43957 639 Bypass 2022-03-16 2022-03-22
5.0
 None Remote Low Not required Partial None None
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
3 CVE-2021-43956 1321 2022-03-16 2022-03-22
4.3
 None Remote Medium Not required None Partial None
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
4 CVE-2021-43955 668 +Info 2022-03-16 2022-03-22
4.0
 None Remote Low ??? Partial None None
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
5 CVE-2021-43954 918 2022-03-14 2022-03-18
4.0
 None Remote Low ??? Partial None None
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
6 CVE-2020-29446 200 +Info 2021-01-18 2021-07-21
5.0
 None Remote Low Not required Partial None None
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
7 CVE-2020-14192 200 +Info 2021-02-02 2021-02-04
4.0
 None Remote Low ??? Partial None None
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
8 CVE-2020-14191 862 DoS 2020-11-25 2021-07-21
5.0
 None Remote Low Not required None None Partial
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
9 CVE-2020-14190 862 DoS 2020-11-25 2021-07-21
5.0
 None Remote Low Not required None None Partial
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
10 CVE-2020-4023 79 XSS 2020-06-01 2020-06-02
4.3
 None Remote Medium Not required None Partial None
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
11 CVE-2020-4018 352 CSRF 2020-06-01 2020-06-02
6.8
 None Remote Medium Not required Partial Partial Partial
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.
12 CVE-2020-4017 200 +Info 2020-06-01 2021-07-21
5.0
 None Remote Low Not required Partial None None
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.
13 CVE-2020-4016 200 +Info 2020-06-01 2021-07-21
5.0
 None Remote Low Not required Partial None None
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.
14 CVE-2020-4015 200 +Info 2020-06-01 2021-07-21
4.0
 None Remote Low ??? Partial None None
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.
15 CVE-2020-4014 863 2020-06-01 2021-07-21
4.0
 None Remote Low ??? None Partial None
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.
16 CVE-2020-4013 79 XSS 2020-06-01 2020-06-02
3.5
 None Remote Medium ??? None Partial None
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.
17 CVE-2019-15009 2019-12-11 2020-08-24
4.0
 None Remote Low ??? None Partial None
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.
18 CVE-2019-15008 79 XSS 2019-12-11 2019-12-12
4.3
 None Remote Medium Not required None Partial None
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.
19 CVE-2019-15007 79 XSS 2019-12-11 2019-12-12
3.5
 None Remote Medium ??? None Partial None
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.
20 CVE-2019-15005 862 2019-11-08 2019-11-14
4.0
 None Remote Low ??? Partial None None
The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2.
21 CVE-2018-20241 79 XSS 2019-02-20 2019-02-26
3.5
 None Remote Medium ??? None Partial None
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
22 CVE-2018-20240 79 XSS 2019-02-20 2019-02-26
3.5
 None Remote Medium ??? None Partial None
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
23 CVE-2018-13399 732 2018-10-16 2019-10-03
4.6
 None Local Low Not required Partial Partial Partial
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
24 CVE-2018-13398 352 CSRF 2018-09-18 2018-12-13
4.3
 None Remote Medium Not required None Partial None
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.
25 CVE-2018-13392 79 XSS 2018-08-13 2018-10-10
4.3
 None Remote Medium Not required None Partial None
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.
26 CVE-2018-13388 79 XSS 2018-07-10 2018-09-04
3.5
 None Remote Medium ??? None Partial None
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
27 CVE-2018-5228 79 XSS 2018-04-24 2018-06-06
4.3
 None Remote Medium Not required None Partial None
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
28 CVE-2018-5223 20 Exec Code 2018-03-29 2018-04-24
6.5
 None Remote Low ??? Partial Partial Partial
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
29 CVE-2017-18112 200 +Info 2020-08-05 2020-08-11
4.0
 None Remote Low ??? Partial None None
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
30 CVE-2017-18094 79 XSS 2018-03-22 2018-04-18
3.5
 None Remote Medium ??? None Partial None
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
31 CVE-2017-18093 79 XSS 2018-02-19 2018-03-12
3.5
 None Remote Medium ??? None Partial None
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
32 CVE-2017-18091 79 XSS 2018-02-16 2018-03-06
3.5
 None Remote Medium ??? None Partial None
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
33 CVE-2017-18035 862 2018-02-02 2019-10-09
4.0
 None Remote Low ??? Partial None None
The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.
34 CVE-2017-18034 79 XSS 2018-02-02 2020-11-25
3.5
 None Remote Medium ??? None Partial None
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.
35 CVE-2017-16861 Exec Code 2018-02-01 2019-10-03
7.5
 None Remote Low Not required Partial Partial Partial
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
36 CVE-2017-16859 22 Dir. Trav. 2018-06-28 2018-08-23
4.0
 None Remote Low ??? Partial None None
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
37 CVE-2017-14591 88 Exec Code 2017-11-29 2017-12-20
9.3
 None Remote Medium Not required Complete Complete Complete
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
38 CVE-2017-14588 79 XSS 2017-10-11 2020-11-25
4.3
 None Remote Medium Not required None Partial None
Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.
39 CVE-2017-14587 79 XSS 2017-10-11 2020-11-25
3.5
 None Remote Medium ??? None Partial None
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
40 CVE-2017-9512 200 +Info 2017-08-24 2020-11-25
5.0
 None Remote Low Not required Partial None None
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
41 CVE-2017-9510 79 XSS 2017-08-24 2020-11-25
3.5
 None Remote Medium ??? None Partial None
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
42 CVE-2017-9509 79 XSS 2017-08-24 2018-01-31
3.5
 None Remote Medium ??? None Partial None
The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.
43 CVE-2017-9507 79 XSS 2017-08-24 2018-01-31
3.5
 None Remote Medium ??? None Partial None
The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.
44 CVE-2012-2926 DoS 2012-05-22 2021-12-13
6.4
 None Remote Low Not required Partial None Partial
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Total number of vulnerabilities : 44   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.