Cross site request forgery (csrf)

The Atlassian Application Links plugin is vulnerable to cross-site request forgery CSRF. The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version...

CVE-2019-20099

The CVE-2019-20099 issue affects Atlassian Jira Server and Data Center (pre-8.7.0); the VerifyPopServerConnection!add.jspa component is vulnerable to CSRF, enabling an attacker to trick an admin into actions that enumerate internal hosts/ports. A fix is available in 8.7.0+; upgrade to 8.7.0 or la...

CVE-2019-20100

The Atlassian Application Links plugin is vulnerable to cross-site request forgery CSRF. The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version...

CVE-2019-20098

CVE-2019-20098 is a CSRF vulnerability in Atlassian Jira Server and Data Center, affecting the VerifySmtpServerConnection!add.jspa component before version 8.7.0. An attacker could trick an administrative user into making malicious HTTP requests, enabling enumeration of hosts and open ports on th...

Security Advisory - Input Validation Vulnerability in Huawei Products

Products Switches Routers WLAN Storage See All Solutions Cloud Data Center Enterprise Networking Intelligent Computing Solutions by Industry See All Services Training and Certification Industry Cloud Enablement Service Improvement Service Customer Support Service See All Partner Find a Partner...

Security Advisory - Double Free Memory Vulnerability in Huawei Products

Products Switches Routers WLAN Storage See All Solutions Cloud Data Center Enterprise Networking Intelligent Computing Solutions by Industry See All Services Training and Certification Industry Cloud Enablement Service Improvement Service Customer Support Service See All Partner Find a Partner...

Atlassian Jira Server and Data Center Authorization Issues Vulnerability (CNVD-2020-04825)

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An authorization issue vulnerability exists in Atlassian Jira Server and Data Center. The vulnerability stems from a lack of...

Atlassian Jira Server and Data Center Security Bypass Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira Server and Data Center. Allows a remote attacker to comment on tickets for whi...

Atlassian Jira Server and Data Center Authorization Issues Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An authorization issue vulnerability exists in Atlassian Jira Server and Data Center. The vulnerability stems from a lack of...

Atlassian Jira Server and Data Center Information Disclosure Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in Atlassian Jira Server and Data Center. The vulnerability arises from a...

Atlassian Jira Server and Data Center Cross-Site Request Forgery Vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A cross-site request forgery vulnerability exists in Atlassian Jira Server and Data Center. The vulnerability stems from a WEB...

CVE-2019-20404

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability...

CVE-2019-20405

The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery CSRF vulnerability...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

CVE-2019-20402

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

CVE-2019-20106

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug...

Authorization

Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability...

Information disclosure

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability...

CVE-2019-20404

The CVE-2019-20404 vulnerability affects Atlassian Jira Server/Data Center prior to version 8.6.0. It is an information-disclosure issue caused by improper authorization, enabling authenticated remote attackers to enumerate project titles they should not access. The issue is confirmed by multiple...

CVE-2019-20405

Atlassian Jira Server/Data Center is affected by CVE-2019-20405 due to a CSRF flaw in the JMX monitoring flag. Before version 8.6.0, an unauthenticated remote attacker could trick a user into visiting a crafted page to turn the JMX monitoring flag on or off. The issue is tied to the JMX monitorin...