Atlassian vulnerabilities
409 CVEs and advisories name Atlassian as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-13392Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a
- CVE-2018-13390Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subne
- CVE-2018-13386There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories.
- CVE-2018-13385There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories.
- CVE-2017-18104The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are a
- CVE-2018-5232The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to i
- CVE-2017-18103The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the
- CVE-2018-5229The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to injec
- CVE-2018-13387The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0
- CVE-2018-13389The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Bro
- CVE-2018-13388The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or Ja
- CVE-2017-16859The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.
- CVE-2018-5231The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before v
- CVE-2018-5230The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4
- CVE-2017-16860The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versio
- CVE-2018-5226There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted.
- CVE-2018-5228The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScr
- CVE-2017-18102The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or
- CVE-2018-5227Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administra
- CVE-2017-18101Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.
- CVE-2017-18098The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a c
- CVE-2017-18097The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to i
- CVE-2017-18096The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allo
- CVE-2018-5224Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argu
- CVE-2018-5223Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may
- CVE-2018-5225In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before
- CVE-2017-18094Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with
- CVE-2017-18095The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attacker
- CVE-2017-18093Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attacke
- CVE-2017-18092The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers