CVE-2018-5225

CRITICAL Year: 2018
CVSS v3 Score
9.9
Critical
CVSS v2 Score
6.5
Medium
Weakness Type
CWE-59
View all →

Vulnerability Description

In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.

Related Vulnerabilities

CVE-2017-2916

CRITICAL
CVSS:9.9(Critical)

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an arbitrary file to be overwritt...

CWE-592017

CVE-2003-1233

CRITICAL
CVSS:9.8(Critical)

Pedestal Software Integrity Protection Driver (IPD) 1.3 and earlier allows privileged attackers, such as rootkits, to bypass file access restrictions to the Windows kernel by using the NtCreateSymboli...

CWE-592003

CVE-2018-1000544

CRITICAL
CVSS:9.8(Critical)

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be e...

CWE-592018

CVE-2018-12026

CRITICAL
CVSS:9.8(Critical)

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning commu...

CWE-592018

CVE-2019-18658

CRITICAL
CVSS:9.8(Critical)

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc...

CWE-592019

CVE-2019-7183

CRITICAL
CVSS:9.8(Critical)

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.

CWE-592019