Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
AtlassianJira Server

30 matches found

CVE
CVE•added 2019/08/09 8:15 p.m.•1175 views

CVE-2019-11581

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Da...

9.8CVSS9.5AI score0.94377EPSS
CVE
CVE•added 2019/09/19 3:15 p.m.•209 views

CVE-2019-15001

The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain re...

9CVSS7.4AI score0.12031EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•139 views

CVE-2019-3403

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3CVSS5.4AI score0.828EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•135 views

CVE-2019-8442

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.

7.5CVSS7.2AI score0.92613EPSS
CVE
CVE•added 2019/12/18 4:15 a.m.•113 views

CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project ...

4.3CVSS4.4AI score0.00287EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•111 views

CVE-2019-8451

The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

6.5CVSS6.4AI score0.93059EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•91 views

CVE-2019-3402

The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

6.1CVSS5.8AI score0.33441EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•81 views

CVE-2019-14995

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check.

5.3CVSS5.2AI score0.01198EPSS
CVE
CVE•added 2019/04/30 4:29 p.m.•79 views

CVE-2019-3399

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

7.5CVSS7.4AI score0.00573EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•75 views

CVE-2019-11586

The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00138EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•75 views

CVE-2019-14998

The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection via "cookie tossing" a CSRF cookie from a subdomain of a Jira instance.

6.5CVSS6.5AI score0.00368EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•75 views

CVE-2019-3401

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3CVSS5.2AI score0.8331EPSS
CVE
CVE•added 2019/04/30 4:29 p.m.•73 views

CVE-2018-20239

Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the appl...

5.4CVSS5.2AI score0.00407EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•70 views

CVE-2019-8446

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3CVSS5.3AI score0.70181EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•69 views

CVE-2019-8443

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenti...

8.1CVSS8AI score0.00783EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•65 views

CVE-2019-14997

The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose through caching vulnerability when Jira is configured with a reverse Proxy and or a load balancer with caching or a CDN.

4.3CVSS4.7AI score0.00329EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•64 views

CVE-2019-11585

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

6.1CVSS6.1AI score0.0025EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•61 views

CVE-2019-8444

The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.

5.4CVSS5.3AI score0.00327EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•60 views

CVE-2019-8447

The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00152EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•58 views

CVE-2018-13404

The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from versi...

4.1CVSS4AI score0.00246EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•58 views

CVE-2019-11588

The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00261EPSS
CVE
CVE•added 2019/05/03 8:29 p.m.•55 views

CVE-2019-3400

The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.

6.1CVSS5.9AI score0.0047EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•55 views

CVE-2019-8445

Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check.

5.3CVSS5.2AI score0.00902EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•53 views

CVE-2018-13403

The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of ...

5.4CVSS5.2AI score0.00173EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•51 views

CVE-2019-14996

The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

6.1CVSS5.9AI score0.00343EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•49 views

CVE-2019-11587

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

6.5CVSS6.4AI score0.00138EPSS
CVE
CVE•added 2019/08/13 3:15 p.m.•49 views

CVE-2019-8448

The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

5.3CVSS5.1AI score0.00369EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•47 views

CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipul...

5.4CVSS5.2AI score0.0018EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•40 views

CVE-2019-11589

The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vul...

6.1CVSS6.2AI score0.00271EPSS
CVE
CVE•added 2019/09/11 2:15 p.m.•38 views

CVE-2019-8450

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom fi...

4.8CVSS4.9AI score0.00287EPSS