CVE-2018-5229

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.

• CWE-79

• https://ecosystem.atlassian.net/browse/UPM-5871Issue Tracking, Patch, Vendor Advisory
• https://ecosystem.atlassian.net/browse/UPM-5871Issue Tracking, Patch, Vendor Advisory

Published

Jul 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5223Fisheye and Crucible did not correctly check if a configured…
• CVE-2018-5224Bamboo did not correctly check if a configured Mercurial rep…
• CVE-2018-5225In browser editing in Atlassian Bitbucket Server from versio…
• CVE-2018-5226There was an argument injection vulnerability in Sourcetree …
• CVE-2018-5227Various administrative application link resources in Atlassi…
• CVE-2018-5228The /browse/~raw resource in Atlassian Fisheye and Crucible …
• CVE-2018-5230The issue collector in Atlassian Jira before version 7.6.6, …
• CVE-2018-5231The ForgotLoginDetails resource in Atlassian Jira before ver…
• CVE-2018-5232The EditIssue.jspa resource in Atlassian Jira before version…
• CVE-2018-5233Cross-site scripting (XSS) vulnerability in system/src/Grav/…
• CVE-2018-5234The Norton Core router prior to v237 may be susceptible to a…
• CVE-2018-5235Norton Utilities (prior to 16.0.3.44) may be susceptible to …