The FishEye and Crucible plugins for JIRA are prone to an unspecified security vulnerability because they fail to properly handle crafted XML data. Exploiting this issue allows remote attackers to cause denial-of- service conditions or to disclose local sensitive files in the context of an affected application. FishEye and Crucible versions up to and including 2.7.11 are vulnerable.
Updates are available. Please see the references for more information.
- Apache Axis2 Document Type Declaration Processing Security Vulnerability
- Apache Struts2 Redirection and Security Bypass Vulnerabilities
- Atutor AContent Multiple SQL Injection and XSS Vulnerabilities
- Atlassian JIRA Privilege Escalation and Multiple Cross Site Scripting Vulnerabilities
- AproxEngine Multiple Remote Input Validation Vulnerabilities