Erin Jensby

Name of the Vulnerable Software and Affected Versions: Atlassian Sourcetree for Windows versions 0.5a through 3.0.14 Description: The issue allows a remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows to exploit an argument injection vulnerability via filenames in Mercurial repositories, potentially gaining code execution on the system. Recommendations: For Atlassian Sourcetree for Windows versions 0.5a through 3.0.14, update to version 3.0.15 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.7.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the `href` parameter. This can be exploited by attackers to execute malicious scripts on the affected system. Recommendations: For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative linker functionality to minimize the risk of exploitation. Avoid using the `href` parameter in the affected functionality until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.7.0 Description: The issue allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the `wbuser` parameter. This occurs in the Edit upload resource for a review. Recommendations: For versions prior to 4.7.0, update to version 4.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Edit upload resource to minimize the risk of exploitation. Avoid using the `wbuser` parameter in the affected resource until the issue is resolved.