Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-13357 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13358 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13359 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "modgroup" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13360 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "filename" URL parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13361 State: PUBLISHED Published: 2018-11-27T21:00:00 Last Updated: 2024-08-05T09:00:35.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the "modgroup" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a
CVE ID: CVE-2018-13365 State: PUBLISHED Published: 2019-05-29T20:50:19 Last Updated: 2024-10-25T14:29:53.480Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via Application Control Block page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-085
CVE ID: CVE-2018-13366 State: PUBLISHED Published: 2019-04-09T16:20:13 Last Updated: 2024-10-25T14:30:39.902Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field defined in connection control setup packets of PPTP protocol. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-101
CVE ID: CVE-2018-13367 State: PUBLISHED Published: 2019-08-23T20:02:58 Last Updated: 2024-10-25T14:28:49.085Z Vendors: Fortinet Products: FortiOS Problem Types: Information disclosure Description: An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, models, via parsing a JavaScript file through admin webUI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-173
CVE ID: CVE-2018-13368 State: PUBLISHED Published: 2019-05-30T16:27:34 Last Updated: 2024-10-25T14:29:31.935Z Vendors: Fortinet Products: Fortinet FortiClient for Windows Problem Types: Execute unauthorized code or commands Description: A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-108
CVE ID: CVE-2018-13371 State: PUBLISHED Published: 2020-04-02T13:29:07 Last Updated: 2024-10-25T14:25:45.587Z Vendors: n/a Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-230
CVE ID: CVE-2018-13372 State: REJECTED Published: N/A Last Updated: 2025-04-29T02:55:09.996Z Description: No description available.
CVE ID: CVE-2018-13374 State: PUBLISHED Published: 2019-01-22T14:00:00.000Z Last Updated: 2025-10-21T23:45:44.273Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortinet Products: Fortinet FortiOS, fortiADC Problem Types: Improper Access Control Description: A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
of the configured one. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-157
CVE ID: CVE-2018-13375 State: PUBLISHED Published: 2019-05-28T18:33:52 Last Updated: 2024-10-25T14:07:04.408Z Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: Execute unauthorized code or commands Description: An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager (with FortiAnalyzer feature enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.
enabled). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-121
CVE ID: CVE-2018-13376 State: PUBLISHED Published: 2018-11-27T15:00:00 Last Updated: 2024-10-25T14:31:22.847Z Vendors: Fortinet, Inc. Products: Fortinet FortiOS Problem Types: Information disclosure Description: An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer response web pages, potentially causing sensitive data to be displayed in the HTTP response. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/106036 - https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180031.txt - https://fortiguard.com/advisory/FG-IR-18-325
CVE ID: CVE-2018-13378 State: PUBLISHED Published: 2019-04-17T14:41:29 Last Updated: 2024-10-25T14:30:28.744Z Vendors: n/a Products: Fortinet FortiSIEM Problem Types: Information disclosure Description: An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-382
CVE ID: CVE-2018-13379 State: PUBLISHED Published: 2019-06-04T20:18:08.000Z Last Updated: 2025-10-21T23:45:35.558Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy Problem Types: Information disclosure Description: An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests. Additional Analyst Notes: - CVE Program Container:
to download system files via special crafted HTTP resource requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-384 - https://www.fortiguard.com/psirt/FG-IR-20-233
CVE ID: CVE-2018-13380 State: PUBLISHED Published: 2019-06-04T20:12:06 Last Updated: 2024-10-25T14:06:52.781Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Fortinet Products: Fortinet FortiOS and FortiProxy Problem Types: Execute unauthorized code or commands Description: A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
or or message handling parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-383 - https://fortiguard.com/advisory/FG-IR-20-230
CVE ID: CVE-2018-13381 State: PUBLISHED Published: 2019-06-04T20:26:34 Last Updated: 2024-10-25T14:29:10.377Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Fortinet Products: Fortinet FortiOS and FortiProxy Problem Types: Denial of service Description: A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier versions under SSL VPN web portal allows a non-authenticated attacker to perform a Denial-of-service attack via special craft message payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard
e payloads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-387 - https://fortiguard.com/advisory/FG-IR-20-232
CVE ID: CVE-2018-13382 State: PUBLISHED Published: 2019-06-04T20:33:53.000Z Last Updated: 2025-10-21T23:45:35.394Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy Problem Types: Improper Access Control Description: An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
portal user via specially crafted HTTP requests Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-389 - https://www.fortiguard.com/psirt/FG-IR-20-231
CVE ID: CVE-2018-13383 State: PUBLISHED Published: 2019-05-29T17:20:03.000Z Last Updated: 2025-10-21T23:45:36.261Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Fortinet Products: Fortinet FortiOS and FortiProxy Problem Types: Denial of service Description: A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
y handle javascript href data when proxying webpages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-18-388 - https://fortiguard.com/advisory/FG-IR-20-229
CVE ID: CVE-2018-13384 State: PUBLISHED Published: 2019-06-04T20:38:13 Last Updated: 2024-10-25T14:06:40.513Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Improper Access Control Description: A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HTTP cache and subsequently redirect SSL VPN web portal users to arbitrary web domains. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-002
CVE ID: CVE-2018-13385 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T22:08:24.595Z Vendors: Atlassian Products: Sourcetree for macOS Problem Types: Argument Injection Description: There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREE-5846
CVE ID: CVE-2018-13386 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T23:56:52.701Z Vendors: Atlassian Products: Sourcetree for Windows Problem Types: Argument Injection Description: There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREEWIN-8884
CVE ID: CVE-2018-13387 State: PUBLISHED Published: 2018-07-16T13:00:00Z Last Updated: 2024-09-17T00:25:48.998Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete. Additional Analyst Notes: - CVE Program Container: References
ld parameter as the fix for CVE-2017-18039 was incomplete. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104890 - https://jira.atlassian.com/browse/JRASERVER-67526
CVE ID: CVE-2018-13388 State: PUBLISHED Published: 2018-07-10T13:00:00Z Last Updated: 2024-09-17T01:40:46.340Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8209 - https://jira.atlassian.com/browse/FE-7059 - http://www.securityfocus.com/bid/104717
CVE ID: CVE-2018-13389 State: PUBLISHED Published: 2018-07-10T13:00:00Z Last Updated: 2024-09-17T01:15:40.877Z Vendors: Atlassian Products: Confluence Problem Types: Content Spoofing Description: The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-54906 - http://www.securityfocus.com/bid/104755
CVE ID: CVE-2018-13390 State: PUBLISHED Published: 2018-08-10T15:00:00Z Last Updated: 2024-09-17T03:38:25.019Z Vendors: Atlassian Products: cloudtoken Problem Types: Improper Restriction of Communication Channel to Intended Endpoints Description: Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/atlassian/cloudtoken/wiki/CVE-2018-13390%20-%20Exposed%20credentials%20in%20daemon%20mode%20on%20Linux
CVE ID: CVE-2018-13391 State: PUBLISHED Published: 2018-08-28T13:00:00Z Last Updated: 2024-09-17T04:18:49.143Z Vendors: Atlassian Products: Jira Problem Types: Information Exposure Description: The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can access & view an issue to obtain the email address of the reporter and assignee user of an issue despite the configured email visibility setting being set to hidden. Additional Analyst Notes
assignee user of an issue despite the configured email visibility setting being set to hidden. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105165 - https://jira.atlassian.com/browse/JRASERVER-67750
CVE ID: CVE-2018-13392 State: PUBLISHED Published: 2018-08-13T13:00:00Z Last Updated: 2024-09-16T23:55:30.972Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8304 - https://jira.atlassian.com/browse/FE-7081 - http://www.securityfocus.com/bid/105096
CVE ID: CVE-2018-13393 State: PUBLISHED Published: 2018-08-15T12:00:00Z Last Updated: 2024-09-16T18:23:29.602Z Vendors: Atlassian Products: Confluence Questions Problem Types: Cross-Site Request Forgery (CSRF) Description: The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105155 - https://jira.atlassian.com/browse/CONFSERVER-56282
CVE ID: CVE-2018-13394 State: PUBLISHED Published: 2018-08-15T12:00:00Z Last Updated: 2024-09-16T22:51:01.482Z Vendors: Atlassian Products: Confluence Questions Problem Types: Cross-Site Request Forgery (CSRF) Description: The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to a fixed version in Confluence version 6.9.0, allows remote attackers to modify a comment into an answer via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-56283 - http://www.securityfocus.com/bid/105284
CVE ID: CVE-2018-13395 State: PUBLISHED Published: 2018-08-28T13:00:00Z Last Updated: 2024-09-16T16:42:34.901Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue while an issue is being moved. Additional Analyst Notes: - CVE Program Container: References: - https://j
ld of an issue while an issue is being moved. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-67848
CVE ID: CVE-2018-13396 State: PUBLISHED Published: 2018-11-05T22:00:00Z Last Updated: 2024-09-16T21:03:34.200Z Vendors: Atlassian Products: Sourcetree for macOS Problem Types: Argument Injection Description: There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREE-5985
CVE ID: CVE-2018-13397 State: PUBLISHED Published: 2018-11-05T22:00:00Z Last Updated: 2024-09-16T23:11:19.581Z Vendors: Atlassian Products: Sourcetree for Windows Problem Types: Argument Injection Description: There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/SRCTREEWIN-9077
CVE ID: CVE-2018-13398 State: PUBLISHED Published: 2018-09-18T14:00:00Z Last Updated: 2024-09-16T18:34:54.617Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross-Site Request Forgery (CSRF) Description: The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7100 - https://jira.atlassian.com/browse/CRUC-8312
CVE ID: CVE-2018-13399 State: PUBLISHED Published: 2018-10-16T13:00:00Z Last Updated: 2024-09-16T20:21:40.541Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Incorrect Permission Assignment for Critical Resource Description: The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7105 - https://jira.atlassian.com/browse/CRUC-8314
CVE ID: CVE-2018-13400 State: PUBLISHED Published: 2018-10-23T14:00:00Z Last Updated: 2024-09-17T01:12:10.955Z Vendors: Atlassian Products: Jira Problem Types: Improper Access Control Description: Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate