Atlassian Jira 8.13.x < 8.14.0 SQLI (JRASERVER-71833)

The version of Atlassian Jira installed on the remote host is prior to 8.13.x 8.14.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-71833 advisory. - Affected versions of Jira Server have a SQL injection vulnerability that has now been fixed by removing the vulnerab...

Atlassian Jira 8.0.x < 8.15.0 (JRASERVER-72052)

The version of Atlassian Jira installed on the remote host is prior to 8.0.x 8.15.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72052 advisory. - Update jQuery to avoid CVE-2020-11022 and CVE-2020-11023 CVE-2020-11022 Note that Nessus has not tested for this issu...

Atlassian Jira < 8.13.16 / 8.14.x < 8.20.5 / 8.21.0 XSRF (JRASERVER-73170)

The version of Atlassian Jira installed on the remote host is prior to 8.13.16 / 8.14.x 8.20.5 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73170 advisory. - CSRF allows toggling Thread Contention and CPU Monitoring - CVE-2021-43953 CVE-2021-43953 Note th...

Atlassian Jira < 8.13.23 / 8.20.0 < 8.20.11 / 8.21.0 < 9.0.0 (JRASERVER-73597)

The version of Atlassian Jira installed on the remote host is prior to 8.13.23 / 8.20.0 8.20.11 / 8.21.0 9.0.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73597 advisory. - Affected versions of Atlassian Jira Server and Data Center allow remote attackers with...

Atlassian Jira < 8.13.18 / 8.14.0 < 8.20.6 / 8.21.0 (JRASERVER-73171)

The version of Atlassian Jira installed on the remote host is prior to 8.13.18 / 8.14.0 8.20.6 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73171 advisory. - Request smuggling via a vulnerable version of Apache Tomcat - CVE-2021-33037 CVE-2021-33037 Note...

Atlassian Jira < 8.5.14 / 8.6.x < 8.13.6 / 8.14.x < 8.16.1 / 8.17.0 (JRASERVER-72695)

The version of Atlassian Jira installed on the remote host is prior to 8.5.14 / 8.6.x 8.13.6 / 8.14.x 8.16.1 / 8.17.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72695 advisory. - Limited Remote File Read in Jira Software Server - CVE-2021-26086 CVE-2021-26086 No...

Atlassian Jira < 8.13.18 / 8.14.0 < 8.20.6 / 8.21.0 (JRASERVER-73070)

The version of Atlassian Jira installed on the remote host is prior to 8.13.18 / 8.14.0 8.20.6 / 8.21.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73070 advisory. - Denial of service via an OutOfMemoryError Tomcat CVE-2021-42340 CVE-2021-42340 Note that Nessus h...

Atlassian Jira 7.13.x < 8.16.0 (JRASERVER-72237)

The version of Atlassian Jira installed on the remote host is prior to 7.13.x 8.16.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72237 advisory. - Denial of Service via /rest/gadget/1.0/createdVsResolved/generate endpoint - CVE-2021-39123 CVE-2021-39123 Note that...

Atlassian Jira 7.2.x < 8.18.1 / 8.19.0 (JRASERVER-72660)

The version of Atlassian Jira installed on the remote host is prior to 7.2.x 8.18.1 / 8.19.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-72660 advisory. - Remote code execution in workflow import - CVE-2017-18113 CVE-2017-18113 Note that Nessus has not tested for...

Atlassian Jira < 8.20.4 / 8.21.x < 8.22.0 (JRASERVER-73592)

The version of Atlassian Jira installed on the remote host is prior to 8.20.4 / 8.21.x 8.22.0. It is, therefore, affected by a vulnerability as referenced in the JRASERVER-73592 advisory. - Affected versions of Atlassian Jira Server and Data Centre allow remote attackers to modify the hierarchy...

Crowd: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Crowd Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Bitbucket: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Bitbucket Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Crucible: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Crucible. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Fisheye: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Fisheye. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Bamboo: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Bamboo Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Confluence: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Confluence Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

JSM: Multiple Servlet Filter Vulnerabilities

Multiple Servlet Filter vulnerabilities have been fixed in Jira Service Management Server and Data Center. These vulnerabilities also affect other Atlassian products. For more information, refer to Atlassian's security...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 - OGNL injection vulnerability: Script proof...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 Confluence Server and Data Center - CVE-2022...

Notifications: upgrade Underscore.js to 1.13.1 or higher

h3. Issue Summary Atlassian Notifications is currently using underscore.js 1.3.3. However, it is being affected due to CVE-2021-23358 The package underscore from 1.13.0-0 and before 1.13.0-2 From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function,...