Atlassian Fisheye
25 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-26137 | | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w | HIGH 8.8 | 2.4 % | ||
| CVE-2022-26136 | | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p | CRITICAL 9.8 | 5.7 % | ||
| CVE-2021-43958 | unspecified – < 4.8.9 | Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest r | CRITICAL 9.8 | 1.5 % | ||
| CVE-2021-43957 | unspecified – < 4.8.9 | Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (I | HIGH 7.5 | 1.3 % | ||
| CVE-2021-43956 | unspecified – < 4.8.9 | The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or Java | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-43955 | unspecified – < 4.8.9 | The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain inf | MEDIUM 4.3 | 0.9 % | ||
| CVE-2021-43954 | unspecified – < 4.8.9 | The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-14192 | unspecified – < 4.8.4 | Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabili | MEDIUM 4.3 | 0.9 % | ||
| CVE-2020-29446 | unspecified – < 4.8.5 | Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDO | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-14190 | unspecified – < 4.8.4 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. | HIGH 7.5 | 1.2 % | ||
| CVE-2020-14191 | unspecified – < 4.8.4 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS | HIGH 7.5 | 1.2 % | ||
| CVE-2017-18112 | unspecified – < 4.8.3 | Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulner | MEDIUM 6.5 | 1.0 % | ||
| CVE-2020-4026 | unspecified – < 4.8.2 | The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from v | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-4023 | unspecified – < 4.8.2 | The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Java | MEDIUM 5.4 | 0.8 % | ||
| CVE-2020-4018 | unspecified – < 4.8.1 | The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross | HIGH 8.8 | 0.6 % | ||
| CVE-2020-4017 | unspecified – < 4.8.1 | The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 al | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-4016 | unspecified – < 4.8.1 | The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows r | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-4015 | unspecified – < 4.8.1 | The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user e | MEDIUM 4.3 | 1.0 % | ||
| CVE-2020-4014 | unspecified – < 4.8.1 | The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-4013 | unspecified – < 4.8.1 | The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript vi | MEDIUM 5.4 | 0.6 % | ||
| CVE-2019-15009 | unspecified – < 4.8.0 | The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove anothe | MEDIUM 4.3 | 0.7 % | ||
| CVE-2019-15008 | unspecified – < 4.7.3 | The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrar | MEDIUM 6.1 | 0.7 % | ||
| CVE-2019-15007 | unspecified – < 4.7.3 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript vi | MEDIUM 4.8 | 0.6 % | ||
| CVE-2019-15005 | unspecified – < 4.7.2 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an | MEDIUM 4.3 | 1.3 % | ||
| CVE-2017-18090 | prior to 4.5.1 ; prior to 4.6.0 | Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to | MEDIUM 6.1 | 0.9 % |