CVE-2019-20901
Published Jul 13, 2020The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may us…
Vendor/product archive
atlassian / jira CVEs
Beta · best-effort143 CVEs tagged to atlassian / jira — 5 Critical, 19 High, 116 Medium, 3 Low, 0 Unrated.
CVE-2019-20899
Published Jul 13, 2020The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the G…
CVE-2019-20898
Published Jul 13, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The…
CVE-2019-20897
Published Jul 13, 2020The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected v…
CVE-2020-14173
Published Jul 3, 2020The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XS…
CVE-2020-14172
Published Jul 3, 2020This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templa…
CVE-2019-20418
Published Jul 3, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability i…
CVE-2020-4029
Published Jul 1, 2020The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows re…
CVE-2020-4025
Published Jul 1, 2020The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 be…
CVE-2020-4024
Published Jul 1, 2020The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject…
CVE-2020-4022
Published Jul 1, 2020The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject…
CVE-2020-14169
Published Jul 1, 2020The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vu…
CVE-2020-14168
Published Jul 1, 2020The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to ac…
CVE-2020-14167
Published Jul 1, 2020The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remot…
CVE-2020-14165
Published Jul 1, 2020The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars name…
CVE-2020-14164
Published Jul 1, 2020The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (X…
CVE-2019-20408
Published Jul 1, 2020The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Reques…
CVE-2019-20416
Published Jun 30, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the proj…
CVE-2019-20415
Published Jun 30, 2020Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability.…
CVE-2019-20414
Published Jun 29, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Na…
CVE-2019-20413
Published Jun 29, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserP…
CVE-2019-20412
Published Jun 29, 2020The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Auth…
CVE-2019-20411
Published Jun 29, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected…
CVE-2019-20410
Published Jun 29, 2020Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restrict…
CVE-2020-4028
Published Jun 23, 2020Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unau…
Showing 51-75 of 143 CVEsPage 3 of 6