CVE-2019-20898

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0...

CVE-2019-20898

CVE-2019-20898 affects Atlassian Jira Server and Data Center before 8.8.0. The vulnerability allows remote attackers to access sensitive information via the Global permissions screen without authentication. Affected versions are

CVE-2019-20897

The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1...

CVE-2019-20897

CVE-2019-20897 affects Atlassian Jira Server and Data Center via the avatar-upload feature, enabling Denial of Service with a crafted PNG. Affected ranges: < 8.5.4, 8.6.0 ≤ 8.6.x < 8.6.2, and 8.7.0

Atlassian JIRA Server and Data Center Information Disclosure Vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Atlassian JIRA < 7.13.14 / 8.5.x < 8.5.5 / 8.8.x < 8.8.2 / 8.9.x < 8.9.1 DoS (JRASERVER-71197)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.3.14, 8.5.x prior to 8.5.5, 8.8.x prior to 8.8.2 or 8.9.x prior to 8.9.1. It is, therefore, affected by a denial of service DoS vulnerability in its Dashboard & Gadgets...

CVE-2020-14171

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...

CVE-2020-14170

Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability...

CVE-2020-14171

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...

Server side request forgery (ssrf)

Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability...

Code injection

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...

CVE-2020-14170

Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability...

CVE-2020-14170

CVE-2020-14170 is an SSRF vulnerability in Atlassian Bitbucket Server Webhooks. Affected versions are 5.4.0 up to, but not including, 7.3.1 (i.e., 5.4.0–7.3.0). A remote attacker could leverage Webhooks to access internal network resources, potentially including metadata endpoints on cloud enviro...

CVE-2020-14171

CVE-2020-14171 affects Atlassian Bitbucket Server: 4.9.0 &lt;= version

CVE-2020-14171

Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle MITM attack...

IDOR Disclosure of Private Project Titles - CVE-2020-14174

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References IDOR vulnerability in the Administration Permission Helper. Affected versions: version 7.13.16 8.0.0 ≤ version 8.5.7 8.6.0 ≤ version 8.9.2...

IDOR Disclosure of Private Project Titles - CVE-2020-14174

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References IDOR vulnerability in the Administration Permission Helper. Affected versions: version 7.13.16 8.0.0 ≤ version 8.5.7 8.6.0 ≤ version 8.9.2...

Atlassian Jira < 7.13.14 / 8.5.x < 8.5.5 / 8.8.x < 8.8.2 / 8.9.0 < 8.9.1 MitM (JRASERVER-71198)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.13.14, or version 8.5.x prior to 8.5.5, 8.8.x prior to 8.8.2, or 8.9.x prior to 8.9.1. It is, therefore, affected by a man-in-the-middle MitM vulnerability in the email clie...

Atlassian JIRA < 8.7.0 SSRF (JRASERVER-71204)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 8.7.0. It is, therefore, affected by a server-side request forgery vulnerability in its makeRequest servlet component. An unauthenticated, remote attacker could exploit this, ...

CVE-2020-14173

The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7....