Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
AtlassianJira Server

29 matches found

CVE
CVE•added 2019/12/18 4:15 a.m.•113 views

CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project ...

4.3CVSS4.4AI score0.00287EPSS
CVE
CVE•added 2020/02/06 3:15 a.m.•113 views

CVE-2019-20106

Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.

4.3CVSS4.6AI score0.00277EPSS
CVE
CVE•added 2022/02/15 1:15 a.m.•107 views

CVE-2021-43952

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.

4.3CVSS4.7AI score0.00247EPSS
CVE
CVE•added 2021/02/15 1:15 a.m.•101 views

CVE-2020-29451

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14....

4.3CVSS4.5AI score0.0016EPSS
CVE
CVE•added 2021/02/15 12:15 a.m.•101 views

CVE-2020-36234

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14...

4.8CVSS5.3AI score0.0023EPSS
CVE
CVE•added 2020/02/06 3:15 a.m.•97 views

CVE-2019-20404

The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability.

4.3CVSS4.5AI score0.01053EPSS
CVE
CVE•added 2020/07/01 2:15 a.m.•97 views

CVE-2020-4029

The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.

4.3CVSS4.6AI score0.0039EPSS
CVE
CVE•added 2021/04/15 12:15 a.m.•96 views

CVE-2021-26076

The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn wh...

4.3CVSS4.2AI score0.00327EPSS
CVE
CVE•added 2020/02/06 3:15 a.m.•95 views

CVE-2019-20405

The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.7AI score0.00232EPSS
CVE
CVE•added 2021/04/15 12:15 a.m.•89 views

CVE-2021-26075

The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an info...

4.3CVSS4.3AI score0.00336EPSS
CVE
CVE•added 2020/07/13 5:15 a.m.•87 views

CVE-2020-14174

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5...

4.3CVSS4.6AI score0.00263EPSS
CVE
CVE•added 2020/06/30 3:15 a.m.•81 views

CVE-2019-20415

Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0.

4.3CVSS4.6AI score0.00232EPSS
CVE
CVE•added 2020/03/17 3:15 a.m.•79 views

CVE-2019-20407

The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.

4.3CVSS4.4AI score0.00263EPSS
CVE
CVE•added 2020/07/01 2:15 a.m.•79 views

CVE-2020-4025

The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site ...

4.8CVSS5AI score0.00335EPSS
CVE
CVE•added 2021/11/01 3:15 a.m.•78 views

CVE-2021-41313

Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.

4.3CVSS4.5AI score0.00243EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•75 views

CVE-2019-11586

The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00138EPSS
CVE
CVE•added 2021/02/02 12:15 a.m.•74 views

CVE-2020-36231

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.

4.3CVSS4.7AI score0.0027EPSS
CVE
CVE•added 2021/08/25 3:15 a.m.•73 views

CVE-2021-39112

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 befo...

4.9CVSS5AI score0.0028EPSS
CVE
CVE•added 2020/02/12 2:15 p.m.•67 views

CVE-2019-20098

The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumera...

4.3CVSS4.5AI score0.0093EPSS
CVE
CVE•added 2021/09/08 2:15 a.m.•67 views

CVE-2021-39121

Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from vers...

4.3CVSS4.7AI score0.004EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•65 views

CVE-2019-14997

The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN.

4.3CVSS4.7AI score0.00329EPSS
CVE
CVE•added 2020/02/12 2:15 p.m.•64 views

CVE-2019-20099

The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerat...

4.3CVSS4.5AI score0.00307EPSS
CVE
CVE•added 2020/02/12 2:15 p.m.•63 views

CVE-2019-20100

The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version ...

4.7CVSS4.5AI score0.00386EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•60 views

CVE-2019-8447

The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00152EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•58 views

CVE-2018-13404

The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from versi...

4.1CVSS4AI score0.00246EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•58 views

CVE-2019-11588

The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00261EPSS
CVE
CVE•added 2020/06/29 6:15 a.m.•50 views

CVE-2019-20411

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.

4.3CVSS4.7AI score0.00199EPSS
CVE
CVE•added 2020/07/13 1:15 a.m.•40 views

CVE-2019-20900

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.

4.8CVSS4.9AI score0.00335EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•38 views

CVE-2019-8450

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom fi...

4.8CVSS4.9AI score0.00287EPSS