Atlassian
Page 5 of 5 — Atlassian CVEs from a corpus of 472, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-9513 | Medium | 5.4 | 2018-01-29 | Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any Confluence page & re… |
CVE-2017-14593 | High | 8.8 | 2018-01-26 | Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a rep… |
CVE-2017-14592 | High | 8.8 | 2018-01-26 | Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repos… |
CVE-2017-16863 | Medium | 6.1 | 2018-01-18 | The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vuln… |
CVE-2017-18033 | Medium | 6.5 | 2018-01-18 | The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import v… |
CVE-2017-16865 | Medium | 5.3 | 2018-01-17 | The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Reques… |
CVE-2017-16864 | Medium | 6.1 | 2018-01-12 | The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS… |
CVE-2017-16862 | Medium | 4.3 | 2018-01-12 | The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-sit… |
CVE-2017-14594 | Medium | 6.1 | 2018-01-12 | The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitr… |
CVE-2017-14590 | Critical | 9.1 | 2017-12-13 | Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to create a repository i… |
CVE-2017-14589 | Critical | 9.6 | 2017-12-13 | It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker who has restricted administration right… |
CVE-2017-16857 | High | 8.5 | 2017-12-05 | It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the back-end. This allows… |
CVE-2017-16856 | Medium | 6.1 | 2017-12-05 | The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) v… |
CVE-2017-14591 | Critical | 9.0 | 2017-11-29 | Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, all… |
CVE-2017-14586 | Critical | 9.8 | 2017-11-27 | The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above… |
CVE-2017-14585 | High | 7.2 | 2017-11-27 | A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2… |
CVE-2017-9514 | High | 8.8 | 2017-10-12 | Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restrict which classes cou… |
CVE-2017-14588 | Medium | 6.1 | 2017-10-11 | Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti… |
CVE-2017-14587 | Medium | 5.4 | 2017-10-11 | The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2015-6576 | High | 8.8 | 2017-10-03 | Bamboo 2.2 before 5.8.5 and 5.9.x before 5.9.7 allows remote attackers with access to the Bamboo web interface to execute arbitrary Java code via an unspecifie… |
CVE-2017-9511 | High | 7.5 | 2017-08-24 | The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traver… |
CVE-2017-9512 | High | 7.5 | 2017-08-24 | The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information… |
CVE-2017-9510 | Medium | 5.4 | 2017-08-24 | The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scr… |
CVE-2017-9509 | Medium | 5.4 | 2017-08-24 | The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scri… |
CVE-2017-9508 | Medium | 5.4 | 2017-08-24 | Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti… |
CVE-2017-9507 | Medium | 5.4 | 2017-08-24 | The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via… |
CVE-2017-9506 | Medium | 6.1 | 2017-08-23 | The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers t… |
CVE-2017-9505 | Medium | 4.3 | 2017-06-15 | Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notification about new comm… |
CVE-2017-8907 | High | 8.8 | 2017-06-14 | Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore t… |
CVE-2017-8080 | High | 8.8 | 2017-05-05 | Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image upload… |
CVE-2017-8058 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker t… |
CVE-2017-8768 | Critical | 9.8 | 2017-05-04 | Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command exec… |
CVE-2017-7415 | High | 7.5 | 2017-04-27 | Atlassian Confluence 6.x before 6.0.7 allows remote attackers to bypass authentication and read any blog or page via the drafts diff REST resource. |
CVE-2017-7357 | Critical | 9.1 | 2017-04-14 | Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file. |
CVE-2017-5983 | Critical | 9.8 | 2017-04-10 | The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execut… |
CVE-2016-4320 | Medium | 4.3 | 2017-04-10 | Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull reques… |
CVE-2016-4319 | High | 8.8 | 2017-04-10 | Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings. |
CVE-2016-4318 | Medium | 4.8 | 2017-04-10 | Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name. |
CVE-2016-4317 | Medium | 5.4 | 2017-04-10 | Atlassian Confluence Server before 5.9.11 has XSS on the viewmyprofile.action page. |
CVE-2016-6285 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitr… |
CVE-2016-6668 | High | 7.5 | 2017-01-23 | The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.2… |
CVE-2016-6283 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileNa… |
CVE-2016-6496 | Critical | 9.8 | 2016-12-09 | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute wit… |
CVE-2016-5229 | Critical | 9.8 | 2016-08-02 | Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute… |
CVE-2015-8399 | Medium | 4.3 | 2016-04-11 | Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecor… |
CVE-2015-8398 | Medium | 6.1 | 2016-04-11 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO… |
CVE-2015-8361 | Critical | 9.1 | 2016-02-08 | Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers to obtain… |
CVE-2015-8360 | Critical | 9.8 | 2016-02-08 | An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows remote attackers to execute arbitrary Java code via serialized data to… |
CVE-2014-9757 | Critical | 9.8 | 2016-02-08 | The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0, allows remote configured XMPP servers to execute arbitra… |
CVE-2015-8481 | Low | 3.1 | 2016-01-08 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user… |
CVE-2015-5603 | | 2015-09-21 | The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related… | |
CVE-2012-6342 | | 2014-05-13 | Cross-site request forgery (CSRF) vulnerability in logout.action in Atlassian Confluence 3.4.6 allows remote attackers to hijack the authentication of administ… | |
CVE-2014-2314 | | 2014-03-09 | Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecifie… | |
CVE-2014-2313 | | 2014-03-09 | Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vect… | |
CVE-2013-5319 | | 2013-08-20 | Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attac… | |
CVE-2013-3926 | | 2013-07-01 | Atlassian Crowd 2.6.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to a "symmetric backdoor." NOTE: as of 20130704, t… | |
CVE-2013-3925 | | 2013-07-01 | Atlassian Crowd 2.5.x before 2.5.4, 2.6.x before 2.6.3, 2.3.8, and 2.4.9 allows remote attackers to read arbitrary files and send HTTP requests to intranet ser… | |
CVE-2012-2928 | | 2012-05-22 | The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML pars… | |
CVE-2012-2927 | | 2012-05-22 | The TM Software Tempo plugin before 6.4.3.1, 6.5.x before 6.5.0.2, and 7.x before 7.0.3 for Atlassian JIRA does not properly restrict the capabilities of third… | |
CVE-2012-2926 | Critical | 9.1 | 2012-05-22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 be… |
CVE-2011-4822 | | 2011-12-15 | Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary we… | |
CVE-2010-1165 | | 2010-04-20 | Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) ind… | |
CVE-2010-1164 | | 2010-04-20 | Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1… | |
CVE-2008-6832 | | 2009-06-08 | Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified v… | |
CVE-2008-6831 | | 2009-06-08 | Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via… | |
CVE-2008-6531 | | 2009-03-26 | The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is… | |
CVE-2007-6619 | | 2008-01-03 | The Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote atta… | |
CVE-2007-6618 | | 2008-01-03 | JIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID. | |
CVE-2007-6617 | | 2008-01-03 | Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2006-3339 | | 2006-07-03 | secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-#156 allows remote attackers to obtain sensitive information via unspecified manipulations of the proj… | |
CVE-2006-3338 | | 2006-07-03 | Cross-site scripting (XSS) vulnerability in Atlassian JIRA 3.6.2-#156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in… | |
CVE-2005-3967 | | 2005-12-03 | Cross-site scripting (XSS) vulnerability in the dosearchsite.action module in Atlassian Confluence 2.0.1 Build 321 allows remote attackers to inject arbitrary… |