Vulnerabilities > Atlassian
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-06-01 | CVE-2020-4019 | Untrusted Search Path vulnerability in Atlassian Companion The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app's cmd.exe via a untrusted search path vulnerability. | 7.8 |
| 2020-06-01 | CVE-2020-4018 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Crucible The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forgery (CSRF) vulnerability. | 8.8 |
| 2020-06-01 | CVE-2020-4017 | Unspecified vulnerability in Atlassian Crucible The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get information about any configured Jira application links via an information disclosure vulnerability. | 5.3 |
| 2020-06-01 | CVE-2020-4016 | Unspecified vulnerability in Atlassian Crucible The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to get the ID of configured Jira application links via an information disclosure vulnerability. | 5.3 |
| 2020-06-01 | CVE-2020-4015 | Unspecified vulnerability in Atlassian Crucible The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a information disclosure vulnerability. | 4.3 |
| 2020-06-01 | CVE-2020-4014 | Unspecified vulnerability in Atlassian Crucible The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings for a repository via an improper authorization vulnerability. | 4.3 |
| 2020-06-01 | CVE-2020-4013 | Cross-site Scripting vulnerability in Atlassian Crucible The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives. | 5.4 |
| 2020-04-22 | CVE-2019-20102 | Cross-site Scripting vulnerability in Atlassian Confluence Server The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter. | 6.1 |
| 2020-03-20 | CVE-2020-9344 | Cross-site Scripting vulnerability in Atlassian Subversion Application Lifecycle Management Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. | 6.1 |
| 2020-03-17 | CVE-2019-20407 | Missing Authorization vulnerability in Atlassian Jira Data Center and Jira Server The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check. | 4.3 |