Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nounce/2019/08/msg00031.html - https://seclists.org/bugtraq/2019/Nov/5 - http://packetstormsecurity.com/files/155095/Slackware-Security-Advisory-libtiff-Updates.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADNPG7JJTRRK22GUVTAFH3GJ6WGKUZJB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63BVT6N5KQPHWOWM4B3I7Z3ODBXUVNPS/ - https://seclists.org/bugtraq/2020/Jan/32 - https://www.debian.org/security/2020/dsa-4608 - https://www.debian.org/security/2020/dsa-4670 - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html - http://lists.opensuse.org/opensuse-security-announ
lists.opensuse.org/opensuse-security-announce/2020-09/msg00102.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00023.html
CVE ID: CVE-2019-14974 State: PUBLISHED Published: 2019-08-14T15:44:12 Last Updated: 2024-08-05T00:34:52.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47247
CVE ID: CVE-2019-14975 State: PUBLISHED Published: 2019-08-14T12:46:26 Last Updated: 2024-08-05T00:34:52.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex MuPDF before 1.16.0 has a heap-based buffer over-read in fz_chartorune in fitz/string.c because pdf/pdf-op-filter.c does not check for a missing string. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=701292 - http://git.ghostscript.com/?p=mupdf.git%3Ba=commit%3Bh=97096297d409ec6f206298444ba00719607e8ba8
CVE ID: CVE-2019-14976 State: PUBLISHED Published: 2019-08-12T21:05:00 Last Updated: 2024-08-05T00:34:53.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/71
CVE ID: CVE-2019-14977 State: REJECTED Published: 2019-08-29T18:21:41 Last Updated: 2019-09-30T13:02:08 Description: No description available.
CVE ID: CVE-2019-14978 State: PUBLISHED Published: 2019-08-29T18:23:41 Last Updated: 2024-08-05T00:34:52.835Z Vendors: n/a Products: n/a Problem Types: n/a Description: /payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price. Additional Analyst Notes: - CVE Program Container: References: - https://gkaim.com/cve-2019-14978-vikas-chaudhary/ - https://wpvulndb.com/vulnerabilities/9959
CVE ID: CVE-2019-14979 State: PUBLISHED Published: 2019-08-29T18:26:37 Last Updated: 2024-11-15T15:03:38.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state Additio
der total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gkaim.com/cve-2019-14979-vikas-chaudhary/ - https://wordpress.org/support/topic/vulnerabilty-in-plugin/#post-11899173
CVE ID: CVE-2019-14980 State: PUBLISHED Published: 2019-08-12T22:06:35 Last Updated: 2024-08-05T00:34:52.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick6/issues/43 - https://github.com/ImageMagick/ImageMagick6/commit/614a257295bdcdeda347086761062ac7658b6830 - https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba - https://github.c
658b6830 - https://github.com/ImageMagick/ImageMagick/commit/c5d012a46ae22be9444326aa37969a3f75daa3ba - https://github.com/ImageMagick/ImageMagick/compare/7.0.8-41...7.0.8-42 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html
CVE ID: CVE-2019-14981 State: PUBLISHED Published: 2019-08-12T22:06:50 Last Updated: 2024-08-05T00:34:53.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ImageMagick/ImageMagick/issues/1552 - https://github.com/ImageMagick/ImageMagick6/commit/b522d2d857d2f75b659936b59b0da9df1682c256 - https://github.com/ImageMagick/ImageMagick/commit/a77d8d97f5a7bced0468f0b08798c83fb67427bc - https://lis
da9df1682c256 - https://github.com/ImageMagick/ImageMagick/commit/a77d8d97f5a7bced0468f0b08798c83fb67427bc - https://lists.debian.org/debian-lts-announce/2019/10/msg00028.html - https://usn.ubuntu.com/4192-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00040.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00042.html - https://www.debian.org/security/2020/dsa-4712 - https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
CVE ID: CVE-2019-14982 State: PUBLISHED Published: 2019-08-12T22:07:00 Last Updated: 2024-08-05T00:34:53.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exiv2/exiv2/issues/960 - https://github.com/Exiv2/exiv2/pull/962/commits/e925bc5addd881543fa503470c8a859e112cca62 - https://github.com/Exiv2/exiv2/compare/v0.27.2-RC2...v0.27.2
CVE ID: CVE-2019-14984 State: PUBLISHED Published: 2019-08-13T19:15:17 Last Updated: 2024-08-05T00:34:52.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14984/
CVE ID: CVE-2019-14985 State: PUBLISHED Published: 2019-08-13T19:17:52 Last Updated: 2024-08-05T00:34:52.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14985/
CVE ID: CVE-2019-14986 State: PUBLISHED Published: 2019-08-13T19:19:44 Last Updated: 2024-08-05T00:34:53.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14986/
CVE ID: CVE-2019-14987 State: PUBLISHED Published: 2019-08-13T03:38:15 Last Updated: 2024-08-05T00:34:52.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/231-adive-framework-2-0-7-xss
CVE ID: CVE-2019-14988 State: REJECTED Published: 2019-08-13T17:48:12 Last Updated: 2019-08-13T17:48:12 Description: No description available.
CVE ID: CVE-2019-14989 State: REJECTED Published: 2019-08-13T17:50:36 Last Updated: 2019-08-13T17:50:36 Description: No description available.
CVE ID: CVE-2019-14990 State: REJECTED Published: 2019-08-13T17:51:33 Last Updated: 2019-08-13T17:51:33 Description: No description available.
CVE ID: CVE-2019-14991 State: REJECTED Published: 2019-08-13T17:52:20 Last Updated: 2019-08-13T17:52:20 Description: No description available.
CVE ID: CVE-2019-14992 State: REJECTED Published: 2019-08-13T17:53:29 Last Updated: 2019-08-13T17:53:29 Description: No description available.
CVE ID: CVE-2019-14993 State: PUBLISHED Published: 2019-08-13T17:38:39 Last Updated: 2024-08-05T00:34:53.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.istio.io/t/upcoming-security-updates-in-istio-1-2-4-and-1-1-13/3383 - https://github.com/envoyproxy/envoy/issues/7728 - https://istio.io/blog/2019/istio-security-003-004/ - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164
CVE ID: CVE-2019-14994 State: PUBLISHED Published: 2019-09-19T14:20:53.238006Z Last Updated: 2024-09-16T18:08:34.171Z Vendors: Atlassian Products: Jira Service Desk Server, Jira Service Desk Data Center Problem Types: Path Traversal Description: The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and version 4.4.0 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that whe
h portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JSDSERVER-6517 - https://seclists.org/bugtraq/2019/Sep/39 - http://packetstormsecurity.com/files/154574/Jira-Service-Desk-Server-And-Data-Center-Path-Traversal.html - https://samcurry.net/analysis-of-cve-2019-14994/
CVE ID: CVE-2019-14995 State: PUBLISHED Published: 2019-09-11T13:56:26.083003Z Last Updated: 2024-09-16T18:24:24.535Z Vendors: Atlassian Products: Jira Problem Types: CWE-863 Description: The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69792 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0836 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0837
CVE ID: CVE-2019-14996 State: PUBLISHED Published: 2019-09-11T13:56:26.155628Z Last Updated: 2024-09-16T18:34:31.193Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69790
CVE ID: CVE-2019-14997 State: PUBLISHED Published: 2019-09-11T13:56:26.203376Z Last Updated: 2024-09-16T18:44:06.559Z Vendors: Atlassian Products: Jira Problem Types: CWE-524 Description: The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69794
CVE ID: CVE-2019-14998 State: PUBLISHED Published: 2019-09-11T13:56:26.253836Z Last Updated: 2024-09-16T22:51:07.147Z Vendors: Atlassian Products: Jira Problem Types: N/A Description: The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69791 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0835
CVE ID: CVE-2019-14999 State: PUBLISHED Published: 2019-08-23T13:49:47.751146Z Last Updated: 2024-09-17T02:05:32.904Z Vendors: Atlassian Products: Universal Plugin Manager Problem Types: Cross-Site Request Forgery (CSRF) Description: The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before version 4.0.3 allows remote attackers to uninstall plugins using a Cross-Site Request Forgery (CSRF) vulnerability on an authenticated administrator. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/UPM-6044
CVE ID: CVE-2019-15000 State: PUBLISHED Published: 2019-09-19T14:24:38.322739Z Last Updated: 2024-09-17T01:41:56.351Z Vendors: Atlassian Products: Bitbucket Server, Bitbucket Data Center Problem Types: Argument Injection Description: The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version for 6.0.x), from 6.1.0 before 6.1.8 (the fixed version for 6.1.x), from 6.2.0 before 6.2.6 (the fixed version for 6.2.x), from 6.3.0 before 6.3.5 (the fixed version for 6.3.x), from 6.4.0 before 6.4.3 (the fixed version for 6.4.x), and from 6.5.0 before 6.5.2 (the fixed version for 6.5.x) allows remote atta
before 6.4.3 (the fixed version for 6.4.x), and from 6.5.0 before 6.5.2 (the fixed version for 6.5.x) allows remote attackers who have permission to access a repository, if public access is enabled for a project or repository then attackers are able to exploit this issue anonymously, to read the contents of arbitrary files on the system and execute commands via injecting additional arguments into git commands. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BSERV-11947 - https://seclists.org/bugtraq/2019/Sep/43 - http://packetstormsecurity.com/files/154610/Bitbucket-Server-Data-Center-Argument-Injection.html
CVE ID: CVE-2019-15001 State: PUBLISHED Published: 2019-09-19T14:28:36.566766Z Last Updated: 2024-09-16T23:55:54.513Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Template injection Description: The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request. Additional Analyst Notes: - CVE Program Container: References: - https://sec
y through the use of a crafted PUT request. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Sep/42 - https://jira.atlassian.com/browse/JRASERVER-69933 - http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html
CVE ID: CVE-2019-15002 State: PUBLISHED Published: 2025-02-11T17:24:15.763Z Last Updated: 2025-03-13T14:15:39.823Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery Description: An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-67979
CVE ID: CVE-2019-15003 State: PUBLISHED Published: 2019-11-07T03:35:38.545958Z Last Updated: 2024-09-16T22:25:56.000Z Vendors: Atlassian Products: Jira Service Desk Server, Jira Service Desk Data Center Problem Types: Authorization Bypass Description: The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in th
e Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JSDSERVER-6590 - https://seclists.org/bugtraq/2019/Nov/9 - http://packetstormsecurity.com/files/155214/Jira-Service-Desk-Server-Data-Center-Path-Traversal.html
CVE ID: CVE-2019-15004 State: PUBLISHED Published: 2019-11-07T03:35:38.947865Z Last Updated: 2024-09-16T23:15:47.761Z Vendors: Atlassian Products: Jira Service Desk Server, Jira Service Desk Data Center Problem Types: Path Traversal Description: The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request i
projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JSDSERVER-6589 - https://seclists.org/bugtraq/2019/Nov/9 - http://packetstormsecurity.com/files/155214/Jira-Service-Desk-Server-Data-Center-Path-Traversal.html
CVE ID: CVE-2019-15005 State: PUBLISHED Published: 2019-11-08T03:55:12.611106Z Last Updated: 2024-09-16T20:31:42.718Z Vendors: Atlassian Products: Bitbucket Server, Jira Server, Confluence Server, Crowd, Fisheye, Crucible, Bamboo Problem Types: Improper Authorization Description: The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data
plication that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira Server / Data Center before 8.3.2, Crowd / Crowd Data Center before 3.6.0, Fisheye before 4.7.2, Crucible before 4.7.2, and Bamboo before 6.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-20647 - https://herolab.usd.de/security-advisories/usd-2019-0016/
CVE ID: CVE-2019-15006 State: PUBLISHED Published: 2019-12-19T00:50:12.007660Z Last Updated: 2024-09-17T01:15:47.661Z Vendors: Atlassian Products: Confluence Server Problem Types: Man-in-the-Middle (MitM) Description: There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additi
e atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center
-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man-in-the-middle (MITM) attack to observe files being edited using the Companion application and/or modify them, and access some limited user information. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-59244 - https://confluence.atlassian.com/doc/confluence-security-advisory-2019-12-18-982324349.html - https://twitter.com/SwiftOnSecurity/status/1202034106495832067 - https://secl
urity-advisory-2019-12-18-982324349.html - https://twitter.com/SwiftOnSecurity/status/1202034106495832067 - https://seclists.org/bugtraq/2019/Dec/36 - http://packetstormsecurity.com/files/155742/Atlassian-Confluence-Man-In-The-Middle.html
CVE ID: CVE-2019-15007 State: PUBLISHED Published: 2019-12-11T14:41:13.287879Z Last Updated: 2024-09-16T23:30:39.186Z Vendors: Atlassian Products: Crucible, Fisheye Problem Types: Cross Site Scripting (XSS) Description: The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8439 - https://jira.atlassian.com/browse/FE-7250