4896 matches found
CVE-2019-15001
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain...
Path traversal
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and...
Design/Logic Flaw
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain...
CVE-2019-15001
CVE-2019-15001 concerns Atlassian Jira Server/Data Center, specifically the Jira Importers Plugin. The vulnerability is a server-side template injection that can be triggered by a crafted PUT request, allowing remote code execution. The issue requires Administrator permissions to exploit and has ...
CVE-2019-15001
The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain...
CVE-2019-14994
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and...
CVE-2019-14994
CVE-2019-14994 affects Atlassian Jira Service Desk Server and Data Center’s Customer Context Filter path traversal vulnerability. Vulnerable versions include Jira Service Desk prior to 3.9.16, 3.10.x before 3.16.8, 4.0.x before 4.1.3, 4.2.x before 4.2.5, 4.3.x before 4.3.4, and 4.4.x before 4.4.1...
Atlassian Jira Tempo Core system plugin information disclosure vulnerability (CNVD-2019-32342)
Atlassian Jira is a defect tracking management system from the Australian company Atlassian. The system is used to track and manage all types of issues and defects in the workplace.Tempo Core system plugin is a project management tool plugin from Icelandic company Tempo that is used in the system...
Atlassian Jira Cross-Site Request Forgery Vulnerability (CNVD-2019-32345)
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A cross-site request forgery vulnerability exists in Atlassian Jira versions prior to 8.4.0, which can be exploited by an attack...
Atlassian Jira Information Disclosure Vulnerability (CNVD-2019-32344)
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in AccessLogFilter in Atlassian Jira versions prior to 8.4.0, which can be...
Atlassian Jira issue attachment name information disclosure vulnerability
Summary An issue attachment name information disclosure vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. Anonymous users can differentiate between valid attachment names and invalid attachment names for any given issue via /rest/api/1.0/render API endpoint. Tested Versions...
Atlassian Jira issueTable username information disclosure vulnerability
Summary An username information disclosure vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. Anonymous users can differentiate between valid usernames and invalid usernames via /rest/issueNav/1/issueTable API endpoint. Tested Versions Atlassian Jira 7.6.4 Atlassian Jira 8.1.0...
Atlassian Jira Issue Key Information Disclosure Vulnerability
Summary An issue key information disclosure vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. Anonymous users can differentiate between valid issue keys and invalid issue keys via the /rest/api/1.0/render API endpoint. Tested Versions Atlassian Jira 7.6.4 Atlassian Jira 8.1.0...
Atlassian Jira CSRF Login Vulnerability
Summary An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account. Tested Versions Atlassian Jira 7.6.4 Atlassian Jira 8.1.0 Product URL...
Atlassian Jira WikiRenderer parser XSS vulnerability
Summary An exploitable XSS vulnerability exists in the WikiRenderer functionality of Atlassian Jira, from version 7.6.4 to 8.1.0. A specially crafted comment can cause a persistent XSS. An attacker can create a comment or worklog entry to trigger this vulnerability. Tested Versions Atlassian Jira...
Atlassian Jira Tempo plugin issue summary information disclosure vulnerability
Summary An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for issues they do not have permission to view via the Tempo plugin. Tested Versions Atlassian Jira 7.6.4 Atlassian Jira Tempo Core syste...
Atlassian Jira CSRF Protections Bypass Vulnerability
Summary An exploitable CSRF vulnerability exists in Atlassian Jira 7.6.4. An attacker controlling a subdomain different that the Jira hosting subdomain enables cookie injection and control of the CSRF header token. An attacker can create a cookie and submit CSRF attacks on behalf of a logged-in...
Atlassian Jira Worklog Information Disclosure Vulnerability
Summary A worklog information disclosure vulnerability exists in Atlassian Jira 7.6.4, from version 7.6.4 to 8.1.0. Authenticated users can view worklog details for issues they do not have permission to view via the /rest/api/2/worklog/list API endpoint. They can also obtain a list of worklog ID’...
