PT-2020-13917

Name of the Vulnerable Software and Affected Versions Atlassian Jira Service Desk Server and Data Center versions prior to 4.12.0 Description The issue allows remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions via an Information Disclosure...

CVE-2020-14180: Undefined Security Weakness

Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions...

PT-2020-13905

Name of the Vulnerable Software and Affected Versions Jira Service Desk Server and Data Center versions prior to 4.10.0 Description The issue allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript via a Cross Site Scripting XSS vulnerability by...

CVE-2020-14166: Improper Neutralization of Input During Web Page Generation

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting XSS vulnerability by uploading a html file...

Customers created via the Customer Portal do not trigger an email verification

In affected versions of Jira Service Desk Server and Data Centre, it was possible to create customers with fake email addresses via the Customer Portal. This is now resolved with email verification. Affected versions: version 3.16.13 4.0.0 ≤ version 4.5.3 4.6.0 ≤ version 4.7.0 Fixed versions:...

Unspecified Vulnerability in Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center Customer Context Filter

Atlassian Jira Service Desk Server and Atlassian Jira Service Desk Data Center are both products of Atlassian Australia.Atlassian Jira Service Desk Server is a suite of Atlassian Jira Service Desk Server is the server version of an IT service desk and request tracking system. The system is used t...

Path traversal

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

PT-2019-13928

Name of the Vulnerable Software and Affected Versions Atlassian Jira Service Desk Server and Jira Service Desk Data Center versions 3.9.16 and earlier Atlassian Jira Service Desk Server and Jira Service Desk Data Center versions 3.10.0 through 3.16.9 Atlassian Jira Service Desk Server and Jira...

CVE-2019-15004: Improper Limitation of a Pathname to a Restricted Directory

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view...

The version of moment.js used in Jira Service Desk was vulnerable to a regular expression denial of service

The version of moment.js used in Jira Service Desk Server before version 4.0.0 allows remote attackers to cause a denial of service in user's browsers via a regular expression denial of service. For additional details...