646 matches found
JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)
The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...
jira-mobile-ssrf-exploit
CVE-2022-26135 - Jira 데이터 센터 및 서버용 모바일 플러그인의 전체 읽기 서버측 요청 위조 Assetnote 소개 Assetnote는 외부 자산을 자동으로 매핑하고 변경 사항과 보안 문제를 모니터링하여 심각한 침해를 방지하는 데 도움을 줍니다. 이 연구는 Assetnote의 보안 연구팀에 의해 수행되었습니다. 제품과 팀에 대한 자세한 내용은 https://assetnote.io에서 확인할 수 있습니다. 블로그 게시물 이 취약점 발견을 위해 수행된 단계를 상세히 설명하는 블로그 게시물은 여기에서 찾을 수 있습니...
Jira-CVE-2019-8451
PoC для CVE-2019-8451 в Jira Описание Концепт-скан для проверки, уязвим ли хост Jira к CVE-2019-8451. CVE-2019-8451 CVE-2019-8451 — это уязвимость подделки серверных запросов SSRF без аутентификации, обнаруженная в ресурсе /plugins/servlet/gadgets/makeRequest. Эта уязвимость появилась в Jira Serv...
CVE-2020-14179
CVE-2020-14179 /secure/QueryComponent!Default.jspa 엔드포인트를 통한 민감한 데이터 노출 우선순위: 높음 영향을 받는 버전: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Atlassian Jira Server 및 Data Center의 영향을 받는 버전에서는 원격의 인증되지 않은 공격자가 /secure/QueryComponent!Default.jspa 엔드포인트의 정보 공개 취약점을 통해 사용자 정의 필드 이름과 사용자 정의 SLA 이름을 볼 수...
CVE-2019-8451
CVE-2019-8451 https://jira.atlassian.com/browse/JRASERVER-69793 root@kitploit: http://host:port/plugins/servlet/gadgets/makeRequest?url=http://:@'.formathost, port, target https://host:port/plugins/servlet/gadgets/makeRequest?url=https://:@'.formathost, port, target...
CVE-2021-26086
CVE-2021-26086 Atlassian Jira Server/Data Center 8.4.0 - 제한된 원격 파일 읽기/포함 취약한 엔드포인트: root@kitploit: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.xml...
Prototype Pollution axios Dependency in Jira Software Data Center and Server
This is a vulnerability in a non-Atlassian dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Prototype Pollution vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Software Data Center and Server. This...
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Software Data Center
This is a vulnerability in a non-Atlassian Jira Software dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability was introduced in versions 9.12.1, 9.16.0, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0,...
HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Software Data Center
This is a vulnerability in a non-Atlassian Jira dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity HTTP Request Smuggling vulnerability was introduced in versions 9.12.1, 10.3.0, 11.3.0 of Jira Software Data Center and Jira...
DoS (Denial of Service) ansi-regex Dependency in Jira Software Data Center and Server
This High severity DoS Denial of Service vulnerability was introduced in version 9.15.2, 9.16.0, 9.17.0, 10.1.1, 10.3.13, 11.2.0 of Jira Software Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of code:java...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability in Mattermost versions 11.1.0 and prior to 11.1.x, 11.0.5 and prior to 11.0.x, 10.12.3 and prior to 10.12.x, and 10.11.7 and prior to 10.11.x, which stems from the Jira plugin'...
XXE (XML External Entity Injection) Tika Dependency in Jira Software Data Center and Server
This Jira Software release includes updates to our Apache Tika dependency in response to CVE-2025-66516. Our security team has assessed that the current scope of this CVE does not present the same critical risk in our products, as our use of the dependency doesn’t support the known path for...
DoS (Denial of Service) software.amazon.ion:ion-java Dependency in Jira Software Data Center and Server
This High severity DoS Denial of Service vulnerability known as CVE-2024-21634 was introduced in 9.12.1 of Jira Software Data Center and Server. This vulnerability with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to take...
DoS (Denial of Service) minimatch Dependency in Jira Software Data Center and Server
This High severity DoS Denial of Service vulnerability known as CVE-2022-3517 was introduced in 10.3.13 of Jira Software Data Center and Server. This vulnerability with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to take...
CVE-2025-22167
This High severity Path Traversal Arbitrary Write vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal Arbitrary Write vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem...
CVE-2025-22167
CVE-2025-22167 is a high-severity path traversal with arbitrary file write in Atlassian Jira Software Data Center and Server. It affects Jira instances in the 9.12.0, 10.3.0, and 11.0.0 lineages, allowing an attacker to modify any filesystem path writable by the Jira JVM process. The CVSS v4.0 ba...
CVE-2025-22167
This High severity Path Traversal Arbitrary Write vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal Arbitrary Write vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem...
EUVD-2020-6324
Malware in sbrugna...