Vendor

Atlassian

409 known vulnerabilities.

Products

Jira Server 99 Jira Data Center 64 Jira 52 Confluence Server 39 Confluence Data Center 39 Crucible 27 Fisheye 25 Bitbucket Server 18 Jira Service Management Data Center 16 Fisheye and Crucible 16 Bitbucket Data Center 14 Jira Server and Data Center 14 Jira Align 13 Crowd 13 Jira Service Management Server 13 Bamboo 12 Bamboo Data Center 10 Sourcetree for Windows 8 Crowd Data Center 7 Jira Software Data Center 7 Bamboo Server 6 Confluence 6 Jira Service Desk Server 5 Jira Software Server 5 Application Links 5 Jira Core Server 5 Atlassian Fisheye and Crucible 5 Jira Service Desk Data Center 4 Crowd Server 4 Sourcetree for macOS 4 Sourcetree for Mac 4 Atlassian Application Links 3 Jira Core Data Center 3 Universal Plugin Manager 3 Confluence Questions 2 Atlassian Crucible 2 Assets Discovery Data Center 2 Companion App 2 Atlassian Connect Spring Boot (ACSB) 2 Atlassian Fisheye 1

All Critical High Medium Low Exploited only Public exploit

409 results · Feed

Unscored —

CVE-2017-18091

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) an…

Atlassian Fisheye and Crucible

Feb 16, 2018
Unscored —

CVE-2017-18089

The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 all…

Atlassian Crucible

Feb 16, 2018
Unscored —

CVE-2017-18090

Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allo…

Atlassian Fisheye

Feb 16, 2018
Unscored —

CVE-2017-18087

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 …

Atlassian Bitbucket Server

Feb 15, 2018
Unscored —

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user…

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attack…

Atlassian Fisheye and Crucible

Feb 2, 2018
Unscored —

CVE-2017-18039

The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to i…

Atlassian Jira Web / CMS

Feb 2, 2018
Unscored —

CVE-2017-18040

The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject ar…

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18038

The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the…

Atlassian Bitbucket Server

Feb 2, 2018
Unscored —

CVE-2017-18085

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject…

Atlassian Confluence Web / CMS

Feb 2, 2018
Unscored —

CVE-2017-18082

The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitra…

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18036

The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine …

Atlassian Bitbucket Server

Feb 2, 2018
Unscored —

CVE-2017-18081

The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or Ja…

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18037

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version…

Atlassian Bitbucket Server

Feb 2, 2018
Unscored —

CVE-2017-18080

The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security …

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18041

The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to …

Atlassian Bamboo

Feb 2, 2018
Unscored —

CVE-2017-18083

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary…

Atlassian Confluence Web / CMS

Feb 2, 2018
Unscored —

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before vers…

Atlassian Fisheye and Crucible

Feb 2, 2018
Unscored —

CVE-2017-18084

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary…

Atlassian Confluence Web / CMS

Feb 2, 2018
Unscored —

CVE-2017-16861

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files t…

Atlassian Fisheye and Crucible

Feb 1, 2018
Unscored —

CVE-2017-16858

The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 be…

Atlassian Crowd

Jan 31, 2018
Unscored —

CVE-2017-9513

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated att…

Atlassian Activity Streams

Jan 29, 2018
Unscored —

CVE-2017-14593

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An att…

Atlassian Sourcetree for Windows Windows

Jan 26, 2018
Unscored —

CVE-2017-14592

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attac…

Atlassian Sourcetree for macOS macOS

Jan 26, 2018
Unscored —

CVE-2017-16863

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScri…

Atlassian Atlassian Jira Web / CMS

Jan 18, 2018
Unscored —

CVE-2017-18033

The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abo…

Atlassian Jira Web / CMS

Jan 18, 2018
Unscored —

CVE-2017-16865

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal ne…

Atlassian Jira Web / CMS

Jan 17, 2018
Unscored —

CVE-2017-16862

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming…

Atlassian Jira Web / CMS

Jan 12, 2018
Unscored —

CVE-2017-16864

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or Ja…

Atlassian Jira Web / CMS

Jan 12, 2018
Unscored —

CVE-2017-14594

The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 …

Atlassian Jira Web / CMS

Jan 12, 2018
Unscored —

CVE-2017-14590

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who…

Atlassian Bamboo

Dec 13, 2017
Unscored —

CVE-2017-14589

It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker…

Atlassian Bamboo

Dec 13, 2017
Unscored —

CVE-2017-16857

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchron…

Atlassian Auto-Unapprove Plugin (for Bitbucket Server)

Dec 5, 2017
Unscored —

CVE-2017-16856

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or Jav…

Atlassian Confluence Web / CMS

Dec 5, 2017
Unscored —

CVE-2017-14591

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through …

Atlassian Fisheye and Crucible

Nov 29, 2017
Unscored —

CVE-2017-14585

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators…

Atlassian Hipchat Data Center Hipchat Server

Nov 27, 2017
Unscored —

CVE-2017-14586

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipc…

Atlassian Hipchat for Mac desktop client

Nov 27, 2017
Unscored —

CVE-2017-9514

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not…

Atlassian Bamboo

Oct 12, 2017
Unscored —

CVE-2017-14588

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTM…

Atlassian Atlassian Fisheye and Crucible

Oct 11, 2017
Unscored —

CVE-2017-14587

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attacker…

Atlassian Atlassian Fisheye and Crucible

Oct 11, 2017

Atlassian

Products

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) an…

The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 all…

Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allo…

The download commit resource in Atlassian Bitbucket Server from version 5.1.0 before version 5.1.7, from version 5.2.0 …

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user…

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attack…

The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to i…

The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject ar…

The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the…

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject…

The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitra…

The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine …

The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or Ja…

The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version…

The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security …

The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to …

The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary…

The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before vers…

The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary…

It was possible for double OGNL evaluation in certain redirect action and in WebWork URL and Anchor tags in JSP files t…

The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 be…

Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated att…

Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An att…

Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attac…

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScri…

The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abo…

The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal ne…

The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming…

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or Ja…

The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 …

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who…

It was possible for double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags to occur. An attacker…

It is possible to bypass the bitbucket auto-unapprove plugin via minimal brute-force because it is relying on asynchron…

The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or Jav…

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through …

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators…

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipc…

Bamboo before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1 had a REST endpoint that parsed a YAML file and did not…

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTM…

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attacker…