Atlassian
Page 4 of 5 — Atlassian CVEs from a corpus of 472, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-8442 | High | 7.5 | 2019-05-22 | The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version… |
CVE-2019-3403 | Medium | 5.3 | 2019-05-22 | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 a… |
CVE-2019-3402 | Medium | 6.1 | 2019-05-22 | The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HT… |
CVE-2019-3401 | Medium | 5.3 | 2019-05-22 | The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an… |
CVE-2019-3400 | Medium | 6.1 | 2019-05-03 | The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2018-20824 | Medium | 6.1 | 2019-05-03 | The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vul… |
CVE-2019-3399 | High | 7.5 | 2019-04-30 | The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for arch… |
CVE-2018-20239 | Medium | 5.4 | 2019-04-30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version… |
CVE-2019-3398 | High | 8.8 | 2019-04-18 | Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attach… |
CVE-2017-18111 | High | 8.7 | 2019-03-29 | The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used… |
CVE-2017-18110 | Medium | 6.5 | 2019-03-29 | The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read… |
CVE-2017-18109 | Medium | 6.1 | 2019-03-29 | The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to… |
CVE-2017-18108 | High | 7.2 | 2019-03-29 | The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary… |
CVE-2017-18106 | High | 7.5 | 2019-03-29 | The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in… |
CVE-2017-18105 | High | 8.1 | 2019-03-29 | The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obt… |
CVE-2019-3396 | Critical | 9.8 | 2019-03-25 | The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed vers… |
CVE-2019-3395 | Critical | 9.8 | 2019-03-25 | The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), from version 6.7.0 before 6.8.5 (the fix… |
CVE-2018-20236 | High | 8.8 | 2019-03-08 | There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a… |
CVE-2018-20235 | High | 8.8 | 2019-03-08 | There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositori… |
CVE-2018-20234 | High | 8.8 | 2019-03-08 | There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercurial repositories… |
CVE-2018-20241 | Medium | 5.4 | 2019-02-20 | The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2018-20240 | Medium | 4.8 | 2019-02-20 | The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript v… |
CVE-2018-20238 | High | 8.1 | 2019-02-13 | Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authenticate using an expi… |
CVE-2018-20237 | Medium | 6.5 | 2019-02-13 | Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word export feature. |
CVE-2018-20232 | Medium | 5.4 | 2019-02-13 | The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML… |
CVE-2018-13404 | Medium | 4.1 | 2019-02-13 | The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8… |
CVE-2018-13403 | Medium | 5.4 | 2019-02-13 | The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before… |
CVE-2016-10740 | Medium | 4.9 | 2019-01-29 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP director… |
CVE-2018-20233 | Medium | 6.5 | 2019-01-18 | The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to rea… |
CVE-2018-1000423 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigura… |
CVE-2018-1000422 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have… |
CVE-2018-1000419 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read acce… |
CVE-2018-1000418 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read acce… |
CVE-2018-13397 | High | 8.8 | 2018-11-05 | There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial reposito… |
CVE-2018-13396 | High | 8.8 | 2018-11-05 | There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories… |
CVE-2018-13402 | Medium | 6.1 | 2018-10-23 | Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 bef… |
CVE-2018-13401 | Medium | 6.1 | 2018-10-23 | The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from ver… |
CVE-2018-13400 | Medium | 4.7 | 2018-10-23 | Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from… |
CVE-2018-13399 | High | 7.8 | 2018-10-16 | The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissio… |
CVE-2018-13398 | Medium | 6.5 | 2018-09-18 | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a… |
CVE-2018-13395 | Medium | 6.1 | 2018-08-28 | Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0… |
CVE-2018-13391 | Medium | 5.3 | 2018-08-28 | The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from… |
CVE-2018-13394 | Medium | 6.5 | 2018-08-15 | The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in… |
CVE-2018-13393 | Medium | 6.5 | 2018-08-15 | The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed… |
CVE-2018-13392 | Medium | 6.1 | 2018-08-13 | Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti… |
CVE-2018-13390 | Medium | 6.1 | 2018-08-10 | Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary… |
CVE-2018-13386 | High | 8.1 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mer… |
CVE-2018-13385 | Critical | 9.8 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercu… |
CVE-2017-18104 | Medium | 5.9 | 2018-07-24 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or o… |
CVE-2018-5232 | Medium | 6.1 | 2018-07-18 | The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTM… |
CVE-2017-18103 | Medium | 4.7 | 2018-07-18 | The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Bro… |
CVE-2018-5229 | Medium | 5.4 | 2018-07-16 | The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or… |
CVE-2018-13387 | Medium | 6.1 | 2018-07-16 | The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8… |
CVE-2018-13389 | Medium | 4.7 | 2018-07-10 | The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attach… |
CVE-2018-13388 | Medium | 5.4 | 2018-07-10 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2018-1000617 | High | 7.5 | 2018-07-09 | Atlassian Floodlight Atlassian Floodlight Controller version 1.2 and earlier versions contains a Denial of Service vulnerability in Forwarding module that can… |
CVE-2017-16859 | Medium | 6.5 | 2018-06-28 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote a… |
CVE-2018-5231 | High | 7.5 | 2018-05-16 | The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and fr… |
CVE-2018-5230 | Medium | 6.1 | 2018-05-14 | The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7… |
CVE-2017-16860 | Medium | 6.1 | 2018-05-14 | The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from version 5.4.0 before vers… |
CVE-2018-5226 | High | 8.8 | 2018-04-25 | There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permiss… |
CVE-2018-5228 | Medium | 6.1 | 2018-04-24 | The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross sit… |
CVE-2017-18102 | Medium | 5.4 | 2018-04-17 | The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a c… |
CVE-2018-5227 | Medium | 4.8 | 2018-04-10 | Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inje… |
CVE-2017-18101 | Medium | 6.5 | 2018-04-10 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version… |
CVE-2017-18100 | Medium | 6.1 | 2018-04-10 | The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XS… |
CVE-2017-18098 | Medium | 6.1 | 2018-04-06 | The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… |
CVE-2017-18097 | Medium | 5.4 | 2018-04-06 | The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello… |
CVE-2017-18096 | High | 7.2 | 2018-04-04 | The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers… |
CVE-2018-5224 | High | 8.8 | 2018-03-29 | Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An… |
CVE-2018-5223 | High | 7.2 | 2018-03-29 | Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument… |
CVE-2018-5225 | Critical | 9.9 | 2018-03-22 | In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed v… |
CVE-2017-18094 | Medium | 4.8 | 2018-03-22 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative pri… |
CVE-2015-6569 | Medium | 5.9 | 2018-02-21 | Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer… |
CVE-2017-18095 | Medium | 5.3 | 2018-02-19 | The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on sni… |
CVE-2017-18093 | Medium | 4.8 | 2018-02-19 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permiss… |
CVE-2017-18092 | Medium | 5.4 | 2018-02-19 | The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrar… |
CVE-2017-18091 | Medium | 4.8 | 2018-02-16 | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers w… |
CVE-2017-18090 | Medium | 6.1 | 2018-02-16 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary H… |
CVE-2017-18089 | Medium | 5.4 | 2018-02-16 | The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary… |
CVE-2017-18088 | Medium | 4.3 | 2018-02-15 | Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.6 (the fixed v… |
CVE-2017-18087 | High | 7.5 | 2018-02-15 | The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0… |
CVE-2017-18086 | Medium | 6.1 | 2018-02-02 | Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… |
CVE-2017-18085 | Medium | 6.1 | 2018-02-02 | The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2017-18084 | Medium | 4.8 | 2018-02-02 | The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2017-18083 | Medium | 5.4 | 2018-02-02 | The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2017-18082 | Medium | 5.4 | 2018-02-02 | The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site s… |
CVE-2017-18081 | Medium | 6.1 | 2018-02-02 | The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS… |
CVE-2017-18080 | High | 8.8 | 2018-02-02 | The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forger… |
CVE-2017-18042 | High | 8.8 | 2018-02-02 | The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-si… |
CVE-2017-18041 | Medium | 5.4 | 2018-02-02 | The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2017-18040 | Medium | 5.4 | 2018-02-02 | The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross s… |
CVE-2017-18039 | Medium | 6.1 | 2018-02-02 | The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a… |
CVE-2017-18038 | Medium | 5.3 | 2018-02-02 | The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a pat… |
CVE-2017-18037 | Medium | 6.5 | 2018-02-02 | The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before… |
CVE-2017-18036 | Medium | 4.3 | 2018-02-02 | The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they could not otherwise re… |
CVE-2017-18035 | Medium | 4.3 | 2018-02-02 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permis… |
CVE-2017-18034 | Medium | 5.4 | 2018-02-02 | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed… |
CVE-2017-16861 | Critical | 9.8 | 2018-02-01 | It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the… |
CVE-2017-16858 | Medium | 6.8 | 2018-01-31 | The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker t… |