4 matches found
CVE-2020-36287
CVE-2020-36287 Jira Server 和 Jira Data Center 版本 8.13.5 之前，以及 8.14.0 至 8.15.1 之前版本中使用的 Atlassian 插件（gadgets plugin）的仪表盘小工具偏好设置资源，由于缺少权限检查，允许远程匿名攻击者获取小工具相关设置。 root@kitploit: Affected software: Atlassian Jira Data Center, Jira Server also tested on Jira Project Management Software Affected Vesrion:...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...
Reflected xss in the jira-gadgets-plugin getLabelGroups rest resource
The jira-gadgets-plugin LabelsResource class exposes a getLabelGroups rest resource that is vulnerable to reflected xss through the user supplied 'project' path parameter. The vulnerability is caused by building an error response message with a content type of text/html and not html encoding the...