BI
DevOps
Bitbucket
On CISA KEVExploited in the wild
22
CVEs
2
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 5High 9Medium 8Low 0
Watch
Add Bitbucket to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-36804 In wildKEV | 8.8 | Aug 25 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability Affected: 7.0.0 before unspecified; before 7.6.17; 7.7.0 before unspecified; before 7.17.10; 7.18.0 before unspecified; before 7.21.4; +8 more |
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: 4.6.0 through 8.14.6 |
| CVE-2018-5225 | 9.9 | Mar 22 | In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x),… Affected: 4.13.0 before 5.4.8; after 5.5.0 before 5.5.8; 5.6.0 before 5.6.5; 5.7.0 before 5.7.3; 5.8.0 before 5.8.2 |
| CVE-2022-43781 | 9.8 | Nov 17 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center Affected: 7.0.0 before 7.6.19; 7.7.0 before 7.17.12; 7.18.0 before 7.21.6; 7.22.0 before 8.0.5; 8.1.0 before 8.1.5; 8.2.0 before 8.2.4; +2 more |
| CVE-2022-26136 | 9.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps Affected: before 7.6.16; 7.7.0 before 7.17.8; 7.18.0 before 7.19.5; 7.20.0 before 7.20.2; 7.21.0 before 7.21.2; 8.0.0; +1 more |
| CVE-2019-15000 | 9.8 | Sep 19 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version for 6.0.x), from… Affected: 5.16.0 before 5.16.10; 6.0.0 before 6.0.10; 6.1.0 before 6.1.8; 6.2.0 before 6.2.6; 6.3.0 before 6.3.5; 6.4.0 before 6.4.3; +1 more |
| CVE-2019-3397 | 9.1 | Jun 3 | Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed version for 5.14.x),… Affected: 5.13.0 before 5.13.6; 5.14.0 before 5.14.4; 5.15.0 before 5.15.3; 5.16.0 before 5.16.3; 6.0.0 before 6.0.3; 6.1.0 before 6.1.2 |
| CVE-2023-22513 | 8.8 | Sep 19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server Affected: 8.9.0 before 8.9.5; 8.10.0 before 8.10.5; 8.11.0 before 8.11.4; 8.12.0 before 8.12.2; 8.13.0 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: before 7.6.16; 7.7.0 before 7.17.8; 7.18.0 before 7.19.5; 7.20.0 before 7.20.2; 7.21.0 before 7.21.2; 8.0.0; +1 more |
| CVE-2019-20097 | 8.8 | Jan 15 | Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0… Affected: 1.0.0 before 5.6.11; 6.0.0 before 6.0.11; 6.1.0 before 6.1.9; 6.2.0 before 6.2.7; 6.3.0 before 6.3.6; 6.4.0 before 6.4.4; +5 more |
| CVE-2019-15012 | 8.8 | Jan 15 | Bitbucket Server and Bitbucket Data Center from version 4.13 Affected: 4.13.0 before 5.6.11; 6.0.0 before 6.0.11; 6.1.0 before 6.1.9; 6.2.0 before 6.2.7; 6.3.0 before 6.3.6; 6.4.0 before 6.4.4; +5 more |
| CVE-2019-15010 | 8.8 | Jan 15 | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from… Affected: 3.0.0 before 5.6.11; 6.0.0 before 6.0.11; 6.1.0 before 6.1.9; 6.2.0 before 6.2.7; 6.3.0 before 6.3.6; 6.4.0 before 6.4.4; +5 more |
| CVE-2020-36233 | 7.8 | Feb 18 | The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers… Affected: before 6.10.9; 7.0.0 before 7.6.4; 7.7.0 before 7.10.1 |
| CVE-2017-18087 | 7.5 | Feb 15 | The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 before version 5.2.5, from version 5.3.0 before version… Affected: 5.1.0 before 5.1.7; 5.2.0 before 5.2.5; 5.3.0 before 5.3.3; after 5.4.0 before 5.4.1 |
| CVE-2020-14171 | 6.5 | Jul 9 | Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM)… Affected: 4.9.0 before 7.2.4 |
| CVE-2017-18037 | 6.5 | Feb 2 | The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed… Affected: 3.7.0 before 4.14.11; 5.0.0 before 5.0.9; 5.1.0 before 5.1.8; 5.2.0 before 5.2.6; 5.3.0 before 5.3.4; 5.4.0 before 5.4.2; +6 more |
| CVE-2017-18038 | 5.3 | Feb 2 | The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal… Affected: before 5.6.0 |
| CVE-2020-14170 | 4.3 | Jul 9 | Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request… Affected: 5.4.0 before 7.3.1 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 6.6.0 |
| CVE-2017-18088 | 4.3 | Feb 15 | Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.6 (the fixed version for 5.4.x),… Affected: 5.3.0 before 5.3.7; 5.4.0 before 5.4.6; 5.5.0 before 5.5.6; 5.6.0 before 5.6.3; 5.7.0 before 5.7.1 |
| CVE-2017-18036 | 4.3 | Feb 2 | The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they could not otherwise reach has open ports… Affected: before 5.3.0 |
| CVE-2016-4320 | 4.3 | Apr 10 | Atlassian Bitbucket Server before 4.7.1 allows remote attackers to read the first line of an arbitrary file via a directory traversal attack on the pull requests resource Affected: before 4.7.1 |
Showing 22