Cached content persisting after disabling anonymous access for allowlist URLs - CVE-2021-39113

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version...

Atlassian Jira 8.6.x < 8.12.3 Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9, 8.6.x 8.12.3 or 8.13.x 8.13.1. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. Note that the scanner has not...

Atlassian Jira 8.14.x < 8.14.1 Broken Authentication

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.3 or 8.14.x 8.14.1. It is, therefore, affected by a broken authentication vulnerability in the makeRequest gadget resource allowing remote attackers to evade...

Atlassian Jira < 8.5.14 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.14, 8.6.x 8.13.6 or 8.14.x 8.16.1. It is, therefore, affected by multiple vulnerabilities: - A Cross-Site Scripting XSS vulnerability in the EditWorkflowScheme.jspa...

Atlassian Jira < 8.5.10 Server-Side Request Forgery

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.10, 8.6.x 8.13.2 or 8.14.x 8.14.1. It is, therefore, affected by a Server-Side Request Forgery SSRF vulnerability allowing unexpected DNS lookups and requests to malicious...

Atlassian Jira 8.6.x < 8.13.4 Cookie Without Secure Flag

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...

Atlassian Jira 8.14.x < 8.14.1 Information Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.14.1. It is, therefore, affected by an information disclosure vulnerability in the Jira Projects plugin report page allowing remote attackers ...

Atlassian Jira 8.6.x < 8.13.3 Information Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.14.1. It is, therefore, affected by an information disclosure vulnerability in the Jira Projects plugin report page allowing remote attackers ...

Atlassian Jira < 8.5.12 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.1. It is, therefore, affected by multiple vulnerabilities: - A DOM based Cross-Site Scripting XSS vulnerability caused by parameter...

Atlassian Jira < 7.13.18 Support Entitlement Number Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.3.18, 8.x 8.5.9 or 8.6.x 8.12.1. It is, therefore, affected by an information disclosure vulnerability in the HTTP Response headers allowing a remote attacker with limited...

Atlassian Jira 8.14.x < 8.17.0 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.15, 8.6.x 8.13.7 or 8.14.x 8.17.0. It is, therefore, affected by multiple vulnerabilities: - A Cross-Site Scripting XSS vulnerability in the CardLayoutConfigTable componen...

Atlassian Jira < 8.5.12 Cookie Without Secure Flag

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x 8.13.4 or 8.14.x 8.15.0. It is, therefore, affected by a missing cookie secure flag vulnerability in jira.editor.user.mode cookie when Jira is configured with...

Atlassian Jira 8.14.x < 8.15.1 Multiple Vulnerabilities (2/2)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.13, 8.6.x 8.13.5 or 8.14.x 8.15.1. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability allowing remote anonymous attackers to...

Atlassian Jira 8.6.x < 8.13.5 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.13, 8.6.x 8.13.5 or 8.14.x 8.15.1. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability allowing remote anonymous attackers to...

Atlassian Jira 8.14.x < 8.16.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.14, 8.6.x 8.13.6 or 8.14.x 8.16.1. It is, therefore, affected by multiple vulnerabilities: - A Cross-Site Scripting XSS vulnerability in the EditWorkflowScheme.jspa...

Atlassian Jira < 8.5.11 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.15.0. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability in the...

Atlassian Jira 8.6.x < 8.13.3 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.11, 8.6.x 8.13.3 or 8.14.x 8.15.0. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability in the...

Atlassian Jira < 8.13.5 Information Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.5 or 8.14.x 8.15.1. It is, therefore, affected by a missing permissions check vulnerability allowing remote anonymous attackers to obtain gadget related settings. Note th...

Atlassian Jira < 8.5.9 Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9, 8.6.x 8.12.3 or 8.13.x 8.13.1. It is, therefore, affected by a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. Note that the scanner has not...

Atlassian Jira 8.6.x < 8.12.0 Information Disclosure

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.3.16, 8.x 8.5.7 or 8.6.x 8.12.0. It is, therefore, affected by an information disclosure vulnerability in the ViewUserHover.jspa endpoint allowing an unauthenticated user to...