Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

48 results

Mar 15, 2022Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not cheCVE-2021-43958 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.8
Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed login limits and therefore required solving a CAPTCHA in addition to providing user credentials for authentication via a improper restriction of excess authentication attempts vulnerability.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Mar 15, 2022Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability iCVE-2021-43957 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory and bypass the fix for CVE-2020-29446 due to a lack of url decoding. The affected versions are before version 4.8.9.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Mar 15, 2022The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototyCVE-2021-43956 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution vulnerability.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Mar 15, 2022The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about instaCVE-2021-43955 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Mar 13, 2022The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumCVE-2021-43954 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Feb 1, 2021Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen resCVE-2020-14192 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from Atlassian Analytics. The affected versions are before version 4.8.4.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jan 17, 2021Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in CVE-2020-29446 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Nov 25, 2020Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL.CVE-2020-14190 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Nov 25, 2020Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in tCVE-2020-14191 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 5, 2020Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the loggiCVE-2017-18112 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross sCVE-2020-4023 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgerCVE-2020-4018 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 8.8
The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackerCVE-2020-4017 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to gCVE-2020-4016 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.3
The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via aCVE-2020-4015 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings fCVE-2020-4014 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jun 1, 2020The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripCVE-2020-4013 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Dec 11, 2019The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite sCVE-2019-15009 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a project via an improper authorization vulnerability.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Dec 11, 2019The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScriptCVE-2019-15008 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Dec 11, 2019The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripCVE-2019-15007 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.
Product
Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Feb 20, 2019The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via CVE-2018-20241 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Feb 20, 2019The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript viCVE-2018-20240 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Oct 16, 2018The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissionCVE-2018-13399 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.8
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Sep 18, 2018The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a CCVE-2018-13398 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 13, 2018Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scriptinCVE-2018-13392 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Jul 10, 2018The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a crossCVE-2018-13388 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Jun 28, 2018The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote atCVE-2017-16859 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read files contained within context path of the running application through a path traversal vulnerability in the command parameter.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Apr 24, 2018The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross siteCVE-2018-5228 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Mar 29, 2018Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument pCVE-2018-5223 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.2
Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An attacker who has permission to add a repository in Fisheye or Crucible can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible on the Windows operating system. All versions of Fisheye and Crucible before 4.4.6 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.3 (the fixed version for 4.5.x) are affected by this vulnerability.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com confluence.atlassian.com
Mar 22, 2018Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privCVE-2017-18094 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Feb 19, 2018Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permissiCVE-2017-18093 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Feb 16, 2018The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers wiCVE-2017-18091 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.8
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Feb 16, 2018Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTCVE-2017-18090 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Feb 2, 2018The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissCVE-2017-18035 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 4.3
The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Feb 2, 2018The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed CVE-2017-18034 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Jan 31, 2018It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur.CVE-2017-16861 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.8
It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur. An attacker who can access the web interface of Fisheye or Crucible or who hosts a website that a user who can access the web interface of Fisheye or Crucible visits, is able to exploit this vulnerability to execute Java code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.5 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.2 (the fixed version for 4.5.x) are affected by this vulnerability.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com confluence.atlassian.com
Nov 29, 2017Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, alloCVE-2017-14591 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9
Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.
Product
Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com confluence.atlassian.com
Oct 11, 2017Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scriptinCVE-2017-14588 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.1
Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.
Product
Atlassian Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Oct 11, 2017The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript CVE-2017-14587 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
Product
Atlassian Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com jira.atlassian.com
Aug 24, 2017The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversCVE-2017-9511 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability when Fisheye or Crucible is running on the Microsoft Windows operating system.
Product
Atlassian Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 24, 2017The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, CVE-2017-9512 · Websites & servers · Atlassian · reported by security@atlassian.comHigh 7.5
The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email addresses of committers, as it lacked permission checks.
Product
Atlassian Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 24, 2017The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scriCVE-2017-9510 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.
Product
Atlassian Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
Aug 24, 2017Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scriptinCVE-2017-9508 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 5.4
Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.
Product
Atlassian Fisheye and Crucible
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.atlassian.com jira.atlassian.com
May 22, 2012Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 befCVE-2012-2926 · Websites & servers · Atlassian · reported by MITRECritical 9.1
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Product
Bamboo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record confluence.atlassian.com confluence.atlassian.com
Dec 14, 2011Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary webCVE-2011-4822 · Websites & servers · Atlassian · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.
Product
Fisheye
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record confluence.atlassian.com osvdb.org
Aug 17, 2010The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other productCVE-2010-1870 · Websites & servers · Apache · reported by MITREMedium 5
The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Product
Struts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.o0o.nu confluence.atlassian.com
Jan 4, 2008Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif contenCVE-2007-6650 · Other software · Bitweaver · reported by MITREHigh 7.5
Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using the image/gif content type, and possibly other image and PDF content types, as demonstrated by uploading a .htaccess file.
Product
R2 CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record osvdb.org bugreport.ir
Jan 12, 2007bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/inCVE-2006-6924 · Other software · Bitweaver · reported by MITREMedium 5
bitweaver 1.3.1 and earlier allows remote attackers to obtain sensitive information via a sort_mode=-98 query string to (1) blogs/list_blogs.php, (2) fisheye/index.php, (3) wiki/orphan_pages.php, or (4) wiki/list_pages.php, which forces a SQL error. NOTE: the fisheye/list_galleries.php vector is already covered by CVE-2005-4380.
Product
Bitweaver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.