XSS in Jira issue filter export file via malicious full name - CVE-2020-14184

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before version 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before...

XSS in Jira issue filter export file via malicious full name - CVE-2020-14184

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before version 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before...

Atlassian Jira < 8.5.8 / 8.6.0 < 8.11.1 Sensitive Data Exposure (JRASERVER-71536)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.8 or 8.6.x 8.11.1. It is, therefore, affected by a sensitive data exposure vulnerability that allows remote, unauthenticated attackers to view custom field names and custo...

Atlassian Jira < 7.13.16 / 8.x < 8.5.7 / 8.6.x < 8.10.2 / 8.11.x < 8.11.1 DoS (JRASERVER-71388)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.3.16, or is 8.x 8.5.7, 8.6.x 8.10.2, or 8.11.x 8.11.0. It is, therefore, affected by a regex-based denial of service DoS vulnerability in JQL version searching. A remote,...

Atlassian Jira < 7.13.16 / 8.x < 8.5.7 / 8.6.x < 8.12.0 User Enumeration (JRASERVER-71560)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.3.16, or is 8.x 8.5.7, or 8.6.x 8.12.0. It is, therefore, affected by an information disclosure vulnerability. An unauthenticated, remote attacker can exploit this, via the...

Pre-Authorization Arbitrary File Read [Confluence, Jira, Crowd]

The VULN ticket can be seen at: https://asecurityteam.atlassian.net/browse/VULN-196971 ---- This issue was reported by an external researcher at https://securitysd.atlassian.net/browse/SEC-2455 . ---- Hello, I am Amit Laish, a security researcher from GE Digital. During one of our assessments we...

U.S. Dept Of Defense: Sensitive data exposure via https://████████.mil/secure/QueryComponent!Default.jspa - CVE-2020-14179

Summary: Information Disclosure vulnerability in outdated Jira. Description: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the...

CVE-2020-14180

Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions...

CVE-2020-14177

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service DoS vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from versi...

CVE-2020-14179

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and...

Denial of service

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service DoS vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from versi...

Information disclosure

Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions...

Information disclosure

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and...

CVE-2020-14177

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service DoS vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from versi...

CVE-2020-14177

CVE-2020-14177 affects Atlassian Jira Server and Data Center with a Regex DoS in JQL version searching. Affected versions are: before 7.13.16; 7.14.0–before 8.5.7; 8.6.0–before 8.10.2; and 8.11.0–before 8.11.1. Fixed versions are 7.13.16, 8.5.7, 8.10.2, 8.11.1, and 8.12.0. A remote attacker could...

CVE-2020-14180

Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions...

CVE-2020-14180

CVE-2020-14180 affects Atlassian Jira Service Desk Server and Data Center; an Information Disclosure vulnerability in the editform request-type-fields resource allows a remote attacker authenticated as a non-administrator to view Project Request-Types and Descriptions. Affected: versions prior to...

CVE-2020-14179

Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and...

CVE-2020-14179

CVE-2020-14179 affects Atlassian Jira Server/Data Center versions before 8.5.8 and 8.6.0 through 8.11.1. The vulnerability is an information disclosure in the /secure/QueryComponent!Default.jspa endpoint, allowing remote, unauthenticated attackers to view custom field names and custom SLA names. ...

Atlassian Jira 8.0 < 8.9.1 XSS in Quick Search (JRASERVER-71205)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 8.x prior to 8.9.1. It is, therefore, affected by a cross-site scripting XSS vulnerability in the quick search component due to improper validation of user-supplied input befor...