CVE-2019-20404: Undefined Security Weakness

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability...

CVE-2019-20403: Undefined Security Weakness

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability...

PT-2020-10420

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.6.0 Description The issue allows remote attackers to determine if a Jira project key exists or not via an information disclosure. Recommendations For versions prior to 8.6.0, update to...

PT-2020-10422

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.6.0 Description The issue allows remote attackers to modify the JMX monitoring flag via a Cross-site request forgery CSRF vulnerability. This can be done by exploiting the JMX monitorin...

CVE-2019-20106: Incorrect Default Permissions

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug...

PT-2020-10342

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 7.13.12 Atlassian Jira Server and Data Center versions 8.0.0 through 8.5.4 Atlassian Jira Server and Data Center versions 8.6.0 through 8.6.1 Description The issue allows remote attackers...

PT-2020-10421

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.6.0 Description The issue allows authenticated remote attackers to determine project titles they do not have access to due to an improper authorization. Recommendations For versions pri...

sdkblog.skobbler.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1084675 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

PT-2019-13927

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions 7.0.10 through 7.6.16 Atlassian Jira Server and Data Center versions 7.7.0 through 7.13.8 Atlassian Jira Server and Data Center versions 8.0.0 through 8.1.3 Atlassian Jira Server and Data Center...

CVE-2019-15001: Improper Control of Generation of Code

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain...

Template injection in Jira importers plugin - CVE-2019-15001

h3. Issue Summary There was a server-side template injection vulnerability in Jira Server and Data Center, in the Jira Importers Plugin JIM. An attacker with "JIRA Administrators" access can exploit this issue. Successful exploitation of this issue allows an attacker to remotely execute code on...

CVE-2019-11581

CVE-2019-11581 affects Jira Server and Data Center (ContactAdministrators and SendBulkMail actions). The vulnerability is a server-side template injection that enables remote code execution when user-supplied input is rendered as a Velocity template. Affected versions include Jira Server/Data Cen...

CVE-2019-11581: Improper Neutralization of Special Elements in Output Used by a Downstream Component

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and...

CVE-2019-11581 - Template injection in various resources

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. For this issue to be exploitable at least one of the following conditions must be met: an SMTP server has been configured in Jira and the Contact...