FI
Product
Fisheye
On CISA KEVExploited in the wild
53
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 11Medium 36Low 0
Watch
Add Fisheye to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-18112 | 6.5 | Aug 5 | Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature Affected: before 4.8.3 |
| CVE-2018-13398 | 6.5 | Sep 18 | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request… Affected: before 4.5.4 |
| CVE-2017-16859 | 6.5 | Jun 28 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.3.2, from version 4.4.0 before 4.4.3 and before version 4.5.0 allows remote attackers to read… Affected: before 4.3.2; 4.4.0 before 4.4.3; 4.4.5 before 4.5.0 |
| CVE-2021-43956 | 6.1 | Mar 16 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaScript via a prototype pollution… Affected: before 4.8.9 |
| CVE-2019-15008 | 6.1 | Dec 11 | The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.3 |
| CVE-2018-13392 | 6.1 | Aug 13 | Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.6.0 |
| CVE-2018-5228 | 6.1 | Apr 24 | The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.5.3 |
| CVE-2017-18090 | 6.1 | Feb 16 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript… Affected: 4.5.0 |
| CVE-2017-14588 | 6.1 | Oct 11 | Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: through 4.4.1 |
| CVE-2020-4023 | 5.4 | Jun 1 | The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS)… Affected: before 4.8.2 |
| CVE-2020-4013 | 5.4 | Jun 1 | The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS)… Affected: before 4.8.1 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 4.7.0 |
| CVE-2018-20241 | 5.4 | Feb 20 | The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.0 |
| CVE-2018-13388 | 5.4 | Jul 10 | The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: before 4.5.3 |
| CVE-2017-18034 | 5.4 | Feb 2 | The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to… Affected: before 4.5.1; 4.6.0 |
| CVE-2017-14587 | 5.4 | Oct 11 | The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: through 4.4.1 |
| CVE-2017-9510 | 5.4 | Aug 24 | The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: through 4.4.0 |
| CVE-2017-9509 | 5.4 | Aug 24 | The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: through 4.4.0 |
| CVE-2017-9508 | 5.4 | Aug 24 | Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: 4.3.1; 4.4.0 |
| CVE-2017-9507 | 5.4 | Aug 24 | The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: through 4.4.0 |
| CVE-2020-29446 | 5.3 | Jan 18 | Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF… Affected: before 4.8.5 |
| CVE-2020-4017 | 5.3 | Jun 1 | The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get… Affected: before 4.8.1 |
| CVE-2020-4016 | 5.3 | Jun 1 | The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of… Affected: before 4.8.1 |
| CVE-2019-15007 | 4.8 | Dec 11 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… Affected: before 4.7.3 |
| CVE-2018-20240 | 4.8 | Feb 20 | The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 4.7.0 |
| CVE-2017-18094 | 4.8 | Mar 22 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject… Affected: 4.4.0 before 4.4.3; 4.5.0 |
| CVE-2017-18093 | 4.8 | Feb 19 | Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify… Affected: 4.4.0 before 4.4.3 |
| CVE-2017-18091 | 4.8 | Feb 16 | The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative… Affected: 4.4.0 before 4.4.3 |
| CVE-2021-43955 | 4.3 | Mar 16 | The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories… Affected: before 4.8.9 |
| CVE-2021-43954 | 4.3 | Mar 14 | The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence… Affected: before 4.8.9 |
| CVE-2020-14192 | 4.3 | Feb 2 | Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen response header from… Affected: before 4.8.4 |
| CVE-2020-4015 | 4.3 | Jun 1 | The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information… Affected: before 4.8.1 |
| CVE-2020-4014 | 4.3 | Jun 1 | The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via… Affected: before 4.8.1 |
| CVE-2019-15009 | 4.3 | Dec 11 | The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite setting for a… Affected: before 4.8.0 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 4.7.2 |
| CVE-2017-18035 | 4.3 | Feb 2 | The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this… Affected: before 4.5.1 |
Showing 36