Atlassian vulnerabilities
409 CVEs and advisories name Atlassian as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2017-14590Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters.
- CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur.
- CVE-2017-16857It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchronous events on the bac
- CVE-2017-16856The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross sit
- CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria
- CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing.
- CVE-2017-14585A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators.
- CVE-2017-9514Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not sufficiently restric
- CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a
- CVE-2017-14587The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary
- CVE-2017-9511The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary file
- CVE-2017-9512The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sen
- CVE-2017-9510The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript v
- CVE-2017-9509The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript vi
- CVE-2017-9508Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a
- CVE-2017-9507The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML
- CVE-2017-9506The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows
- CVE-2017-9505Atlassian Confluence starting with 4.3.0 before 6.2.1 did not check if a user had permission to view a page when creating a workbox notifica
- CVE-2017-8907Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permiss