4 matches found
CVE-2020-36287
CVE-2020-36287 Jira ServerおよびJira Data Centerで使用されるAtlassian gadgetsプラグインのダッシュボードガジェット設定リソースは、バージョン8.13.5より前、およびバージョン8.14.0から8.15.1より前のバージョンにおいて、権限チェックが欠如しているため、リモートの匿名攻撃者がガジェット関連の設定を取得できる脆弱性があります。 root@kitploit: Affected software: Atlassian Jira Data Center, Jira Server also tested on Jira Proje...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...