Authentication flaw

The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types;...

CVE-2019-20413

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service DoS vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2...

CVE-2019-20413

Atlassian Jira Server/Data Center is affected by CVE-2019-20413 due to a Denial of Service vulnerability in the UserPickerBrowser.jspa page caused by missing input validation. Affected versions are before 7.13.9 and 8.0.0 to 8.4.2 (inclusive lower than 8.4.2); fixed in 7.13.9, 8.4.2, and 8.5.0. N...

CVE-2019-20412

The CVE-2019-20412 vulnerability affects Atlassian Jira Server/Data Center on Convert Sub-Task to Issue page. Root cause is an Improper Authentication flaw that lets remote attackers enumerate workflow names, the project key (if part of a workflow name), issue keys, issue types, and status types....

CVE-2019-20411

The CVE-2019-20411 issue affects Atlassian Jira Server/Data Center wallboard settings via a Cross-Site Request Forgery (CSRF) flaw. Affected products/versions: Jira Server/Data Center prior to 7.13.9 and Jira 8.0.0 prior to 8.4.2. Root cause: CSRF on the Wallboard endpoint that enables remote mod...

CVE-2019-20410

CVE-2019-20410 affects Atlassian Jira Server/Data Center via an Information Disclosure vulnerability in the comment restriction feature. Affected versions are before 7.6.17, 7.7.0–7.13.9, and 8.0.0–8.4.2. Remote attackers could view sensitive information; no exploitation details are provided in t...

CVE-2019-20410

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0...

Cisco Data Center Network Manager Multiple Stored Cross-Site Scripting Vulnerablities (June 2020)

A stored cross-site scripting XSS vulnerabilities exists in web-based management interface of Cisco Data Center Network Manager DCNM due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker, administrative credentials can exploit this, by...

Symantec Data Center Security Server Installed (Windows)

Binary data symantecdcslocaldetect.nbin...

CVE-2020-4071

CVE-2020-4071 applies to the django-basic-auth-ip-whitelist package prior to version 0.3.4. The issue is a timing-attack vulnerability caused by a character-by-character string comparison of configured BASIC_AUTH_LOGIN/BASIC_AUTH_PASSWORD against user input, which may allow an attacker within a l...

Atlassian JIRA Server and JIRA Data Center Injection Vulnerabilities

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

SSRF in Webhooks - CVE-2020-14170

Affected versions of Atlassian Bitbucket Data Center allow remote attackers to access the content of internal network resources via a Server-Side Request Forgery SSRF vulnerability in Webhooks. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource...

CVE-2019-20409

The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability...

CVE-2019-20409

CVE-2019-20409 affects Atlassian Jira Server and Data Center versions prior to 8.8.0. The issue arises from how Velocity templates are used, enabling remote attackers to trigger server-side template injection and achieve remote code execution. The confirmed fix is upgrade to Jira 8.8.0 or later. ...

Cisco Data Center Network Manager Unauthenticated File Download

DCNM exposes a servlet to download files on /fm/downloadServlet. An authenticated user can abuse this servlet to download arbitrary files as root by specifying the full path of the file. This module was tested on the DCNM Linux virtual appliance 10.42, 11.01 and 11.11, and should work on a few...

CVE-2020-3356

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability is due to insufficient input validation by the web-based...

CVE-2020-3355

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability is due to insufficient inpu...

CVE-2020-3354

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability is due to insufficient inpu...

Cross site scripting

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. The vulnerability is due to insufficient input validation by the web-based...

Man-in-the-middle in Jira email client - CVE-2020-14168

The email client in Jira Server and Data Center allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle MITM vulnerability Affected versions: version 7.13.14 8.5.0 ≤ version 8.5.5 8.8.0 ≤ version 8.8.2 8.9.0 ≤ version 8.9.1 Fixed version...