Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery

The Atlassian Jira IconUriServlet of the OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 contains a cross-site scripting vulnerability which allows remote attackers to access the content of internal network resources and/or perform an attack via...

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...

CVE-2021-39115

CVE-2021-39115 L'injection de modèles dans les modèles d'e-mail conduit à l'exécution de code sur Jira Service Management Server I Construction J'ai expliqué comment déployer et déboguer ici, vous pouvez vous y référer. II Analyse Dans la Description de ce CVE, il est clairement indiqué que le bu...

CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

CVE-2017-9506

Prueba de concepto SSRF y XSS root@kitploit: https://jira.you.com//plugins/servlet/oauth/users/icon-uri?consumerUri=http://www.google.co.uk CVE-2017-9506 El IconUriServlet del Atlassian OAuth Plugin desde la versión 1.3.0 anterior a la versión 1.9.12 y desde la versión 2.0.0 anterior a la versión...

CVE-2019-11581

Injection de template non authentifiée dans Atlassian Jira CVE-2019-11581 I Construction 1. Version vulnérable root@kitploit: 4.4.x 5.x.x 6.x.x 7.0.x 7.1.x 7.2.x 7.3.x 7.4.x 7.5.x 7.6.x before 7.6.14 the fixed version for 7.6.x 7.7.x 7.8.x 7.9.x 7.10.x 7.11.x 7.12.x 7.13.x before 7.13.5 the fixed...

jira-mobile-ssrf-exploit

CVE-2022-26135 - Falsification de requête côté serveur SSRF en lecture complète dans le plugin mobile pour Jira Data Center et Server À propos d'Assetnote Assetnote cartographie automatiquement vos actifs externes et les surveille pour détecter les changements et les problèmes de sécurité afin de...

VulnWhisperer

Createactionable data from your vulnerability scans VulnWhisperer is a vulnerability management tool and report aggregator. VulnWhisperer will pull all the reports from the different Vulnerability scanners and create a file with a unique filename for each one, using that data later to sync with...

salt-scanner

salt-scanner A linux vulnerability scanner based on Vulners Audit API and Salt Open, with Slack notifications and JIRA integration. Features Slack notification and report upload JIRA integration OpsGenie integration Requirements Salt Open 2016.11.x salt-master, salt-minion¹ Python 2.7 salt you ma...

jira-exploits-cve

jira-exploits-cve Follow us Vulnmachines YouTube Twitter Facebook LinkedIn...

Jira <8.4.0 - Server-Side Request Forgery

Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized...

UserEnumJira

Este repositorio no tiene un README...

CVE-2026-21587

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21587

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

EUVD-2026-78936

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21587

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21587

CVE-2026-21587 is a High severity Improper Authorization vulnerability (CVSS 4.0 score 7.1 ) introduced in Jira Service Management Data Center 11.3.0 . An authenticated attacker can gain unintended access, potentially exposing sensitive information or enabling arbitrary code execution . The flaw ...

CVE-2019-15053

CVE-2019-15053 FAB-2019-00156 Vulnerabilidad descubierta por mí CVE-2019-15053 Aviso: advisory.txt Información Básica root@kitploit: Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and...

CVE-2026-73496

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...

CVE-2026-73496 MCP Atlassian: Arbitrary server-side file read via attachment upload

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...