CVE-2020-29453

CVE-2020-29453 affects Jira Server/Data Center: CachingResourceDownloadRewriteRule allows unauthenticated remote readers to access arbitrary files in WEB-INF and META-INF due to an incorrect path check. Products/versions implicated (per initial sources): before 8.5.11, 8.6.x before 8.13.3, and 8....

CVE-2020-29453

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access che...

CVE-2020-29448

CVE-2020-29448 affects Atlassian Confluence Server/Data Center. Affected ConfluenceResourceDownloadRewriteRule allows unauthenticated remote retrieval of arbitrary files in WEB-INF and META-INF due to an incorrect path access check. Impact is read-only exposure of restricted files; no exploitatio...

Atlassian Bitbucket Server and Data Center Security Vulnerability

Atlassian Bitbucket Server is a Git code hosting solution from Atlassian Australia. The solution is able to manage and review code with features such as diff view, JIRA integration, and build integration. A security vulnerability exists in Atlassian Bitbucket Server and Data Center. The...

DOM XSS in the issue navigation & search view via parameter pollution - CVE-2020-36288

The issue navigation & search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting XSS vulnerability caused b...

Information disclosure

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version...

CVE-2020-29451

CVE-2020-29451 maps to an information-disclosure vulnerability in Atlassian Jira Server/Data Center, affecting the Jira Projects plugin report page. The vulnerability allows a remote attacker to enumerate Jira projects from affected installations. Affected versions are before 8.5.11, 8.6.0 before...

CVE-2020-36234

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14...

CVE-2020-36234

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14...

CVE-2020-36236

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6...

CVE-2020-36236

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6...

CVE-2020-36235

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1...

CVE-2020-36237

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0...

Cross site scripting

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6...

Information disclosure

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0...

CVE-2020-36234

CVE-2020-36234: Atlassian Jira Server/Data Center XSS in Screens Modal view affects Jira versions prior to 8.5.11, 8.6.x before 8.13.3, and 8.14.x before 8.15.0. Root cause is insufficient input validation in the Screens Modal UI, enabling remote attackers to inject arbitrary HTML/JavaScript. Imp...

CVE-2020-36237

CVE-2020-36237 affects Atlassian Jira Server and Data Center prior to 8.15.0, where unauthenticated remote attackers can view custom field options via the /rest/api/2/customFieldOption/ endpoint (information disclosure). Affected versions are before 8.15.0; fixed in 8.15.0. The connected Atlassia...

CVE-2020-36237

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0...

CVE-2020-36236

CVE-2020-36236 affects Atlassian Jira Server/Data Center. The connected documents confirm a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. Affected versions are before 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0. The ...

CVE-2020-36235

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1...