CR
Product
Crucible
On CISA KEVExploited in the wild
53
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 11Medium 37Low 0
Watch
Add Crucible to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: before 4.9.15 |
| CVE-2022-26136 | 9.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps Affected: before 4.8.10 |
| CVE-2021-43958 | 9.8 | Mar 16 | Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were… Affected: before 4.8.9 |
| CVE-2017-16861 | 9.8 | Feb 1 | It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files to occur Affected: before 4.4.5; 4.5.0 before 4.5.2 |
| CVE-2012-2926 | 9.1 | May 22 | Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo… Affected: before 2.5.8; 2.6 before 2.6.8; 2.7 before 2.7.12 |
| CVE-2017-14591 | 9.0 | Nov 29 | Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to… Affected: before 4.4.3; 4.5.0 |
| CVE-2024-21683 | 8.8 | May 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server Affected: 4.8.0 before 4.8.15 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: before 4.8.10 |
| CVE-2020-4018 | 8.8 | Jun 1 | The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF)… Affected: before 4.8.1 |
| CVE-2018-13399 | 7.8 | Oct 16 | The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the… Affected: before 4.6.1 |
| CVE-2021-43957 | 7.5 | Mar 16 | Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF… Affected: before 4.8.9 |
| CVE-2020-14190 | 7.5 | Nov 25 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL Affected: before 4.8.4 |
| CVE-2020-14191 | 7.5 | Nov 25 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the… Affected: before 4.8.4 |
| CVE-2017-9511 | 7.5 | Aug 24 | The MultiPathResource class in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to read arbitrary files via a path traversal vulnerability… Affected: through 4.4.0 |
| CVE-2017-9512 | 7.5 | Aug 24 | The mostActiveCommitters.do resource in Atlassian Fisheye and Crucible, before version 4.4.1 allows anonymous remote attackers to access sensitive information, for example email… Affected: through 4.4.0 |
| CVE-2018-5223 | 7.2 | Mar 29 | Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters Affected: 4.4.0 before 4.4.6; 4.5.0 before 4.5.3 |
| CVE-2018-13398 | 6.5 | Sep 18 | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request… Affected: before 4.5.4 |
| CVE-2017-16859 | 6.5 | Jun 28 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read… Affected: before 4.3.2; 4.4.0 before 4.4.3; 4.4.5 before 4.5.0 |
| CVE-2021-43956 | 6.1 | Mar 16 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution… Affected: before 4.8.9 |
| CVE-2019-15008 | 6.1 | Dec 11 | The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.3 |
| CVE-2018-13392 | 6.1 | Aug 13 | Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.6.0 |
| CVE-2018-5228 | 6.1 | Apr 24 | The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.5.3 |
| CVE-2017-14588 | 6.1 | Oct 11 | Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: through 4.4.1 |
| CVE-2020-4023 | 5.4 | Jun 1 | The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS)… Affected: before 4.8.2 |
| CVE-2020-4013 | 5.4 | Jun 1 | The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS)… Affected: before 4.8.1 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 4.7.0 |
| CVE-2018-20241 | 5.4 | Feb 20 | The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.0 |
| CVE-2018-13388 | 5.4 | Jul 10 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: before 4.5.3 |
| CVE-2017-18092 | 5.4 | Feb 19 | The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript… Affected: before 4.4.3 |
| CVE-2017-18089 | 5.4 | Feb 16 | The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript… Affected: 4.4.0 before 4.4.3 |
| CVE-2017-18034 | 5.4 | Feb 2 | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to… Affected: before 4.5.1; 4.6.0 |
| CVE-2017-14587 | 5.4 | Oct 11 | The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: through 4.4.1 |
| CVE-2017-9509 | 5.4 | Aug 24 | The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: through 4.4.0 |
| CVE-2017-9508 | 5.4 | Aug 24 | Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: 4.3.1; 4.4.0 |
| CVE-2017-9507 | 5.4 | Aug 24 | The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: through 4.4.0 |
| CVE-2020-29446 | 5.3 | Jan 18 | Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF… Affected: before 4.8.5 |
| CVE-2020-4017 | 5.3 | Jun 1 | The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get… Affected: before 4.8.1 |
| CVE-2020-4016 | 5.3 | Jun 1 | The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of… Affected: before 4.8.1 |
| CVE-2017-18095 | 5.3 | Feb 19 | The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not… Affected: before 4.5.1 |
| CVE-2019-15007 | 4.8 | Dec 11 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.7.3 |
| CVE-2018-20240 | 4.8 | Feb 20 | The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.0 |
| CVE-2017-18094 | 4.8 | Mar 22 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject… Affected: 4.4.0 before 4.4.3; 4.5.0 |
| CVE-2017-18093 | 4.8 | Feb 19 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify… Affected: 4.4.0 before 4.4.3 |
| CVE-2017-18091 | 4.8 | Feb 16 | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative… Affected: 4.4.0 before 4.4.3 |
| CVE-2021-43955 | 4.3 | Mar 16 | The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories… Affected: before 4.8.9 |
| CVE-2021-43954 | 4.3 | Mar 14 | The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence… Affected: before 4.8.9 |
| CVE-2020-14192 | 4.3 | Feb 2 | Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from… Affected: before 4.8.4 |
| CVE-2020-29447 | 4.3 | Dec 21 | Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request… Affected: before 4.7.4; 4.8.0 before 4.8.5 |
| CVE-2020-4015 | 4.3 | Jun 1 | The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information… Affected: before 4.8.1 |
| CVE-2020-4014 | 4.3 | Jun 1 | The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via… Affected: before 4.8.1 |