CVE-2020-4027

Atlassian Confluence Server/Data Center is affected by CVE-2020-4027 due to an injection vulnerability in custom user macros that allows remote attackers with system administration permissions to bypass velocity template injection mitigations. Affected versions are before 7.4.5 and 7.5.0 before 7...

CVE-2020-4025

CVE-2020-4025 concerns Atlassian Jira Server/Data Center where the “attachment download” resource allows remote attackers to inject arbitrary HTML or JavaScript via a rdf attachments content type. The vulnerability affects Jira versions: before 8.5.5, then 8.6.0 before 8.8.2, and 8.9.0 before 8.9...

CVE-2020-4024

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability issue attachments with a vnd.wap.xhtml+xml...

CVE-2020-14168

The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle MITM vulnerability...

CVE-2020-4022

CVE-2020-4022 affects Atlassian Jira Server and Data Center: the attachment download resource and issue attachments component allow remote attackers to inject arbitrary HTML or JavaScript via XSS when handling mixed multipart content types. Affected versions include Jira Server/Data Center before...

CVE-2020-4022

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability issue attachments with a mixed multipart...

CVE-2020-14168

The MITM vulnerability CVE-2020-14168 affects Jira Server and Data Center’s email client. Affected: Jira versions prior to 7.13.16; 8.5.x before 8.5.7; 8.8.x before 8.8.2; 8.9.x before 8.9.1. Impact: remote attackers could access outgoing emails between a Jira instance and the SMTP server. Remedi...

CVE-2020-14169

The CVE-2020-14169 vulnerability affects Atlassian Jira Server and Data Center (pre-8.9.1) in the Navigation-Search (quick search) component. The issue is a cross-site scripting (XSS) flaw introduced by improper validation of user-supplied input, allowing remote attackers to inject arbitrary HTML...

CVE-2020-14167

The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service DoS vulnerability...

CVE-2020-14167

CVE-2020-14167 affects Atlassian Jira Server and Data Center via a Denial of Service (DoS) in Dashboard & Gadgets due to the MessageBundleResource handling. Affected: Jira Server/Data Center versions prior to 7.13.14, and Jira 8.5.x before 8.5.5, 8.8.x before 8.8.2, and 8.9.x before 8.9.1. Impact...

CVE-2020-14166

Affected product: Atlassian Jira Service Desk Server and Data Center. Vulnerability: Cross-Site Scripting (XSS) in the /servicedesk/customer/portals endpoint that arises when an HTML file is uploaded via the banner/upload flow. Exploitation requires project administrator privileges and can inject...

CVE-2020-14165

Affected product: Atlassian Jira Server/Data Center. The vulnerability CVE-2020-14165 concerns the UniversalAvatarResource.getAvatars endpoint, where improper authorization in Jira Server/Data Center versions before 8.9.0 allows remote attackers to obtain information about custom project avatar n...

CVE-2020-14165

The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability...

CVE-2019-20415

Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery CSRF vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0...

CVE-2019-20416

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the project configuration feature. The affected versions are before version 8.3.0...

Atlassian JIRA Server and Data Center Authorization Issues Vulnerability (CNVD-2021-17354)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Atlassian JIRA Server and Data Center Information Disclosure Vulnerability (CNVD-2021-17352)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Atlassian JIRA Server and Data Center Input Validation Error Vulnerability

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Atlassian JIRA Server and Data Center Cross-Site Request Forgery Vulnerability (CNVD-2021-17353)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

CVE-2019-20414

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2...