Jira Security Vulnerabilities and Issues — Jira CVE List

Lucene search

AtlassianJira

39 matches found

CVE•added 2021/06/07 11:15 p.m.•150 views

CVE-2021-26078

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

6.1CVSS5.9AI score0.00824EPSS

CVE•added 2019/05/22 6:29 p.m.•91 views

CVE-2019-3402

The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

6.1CVSS5.8AI score0.33441EPSS

CVE•added 2021/02/15 12:15 a.m.•91 views

CVE-2020-36236

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6...

6.1CVSS5.8AI score0.0047EPSS

CVE•added 2021/04/15 12:15 a.m.•91 views

CVE-2020-36288

The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused...

6.1CVSS5.8AI score0.00553EPSS

CVE•added 2019/08/23 2:15 p.m.•88 views

CVE-2019-11584

The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.

6.1CVSS5.5AI score0.00231EPSS

CVE•added 2019/05/03 8:29 p.m.•81 views

CVE-2018-20824

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

6.1CVSS5.9AI score0.46129EPSS

CVE•added 2018/05/14 1:29 p.m.•80 views

CVE-2018-5230

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in t...

6.1CVSS5.9AI score0.20001EPSS

CVE•added 2021/10/26 5:15 a.m.•80 views

CVE-2021-41304

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from ...

6.1CVSS5.9AI score0.0047EPSS

CVE•added 2020/07/01 2:15 a.m.•79 views

CVE-2020-4022

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart con...

6.1CVSS5.8AI score0.00405EPSS

CVE•added 2021/06/07 11:15 p.m.•77 views

CVE-2021-26079

The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

6.1CVSS6AI score0.00435EPSS

CVE•added 2021/10/26 5:15 a.m.•72 views

CVE-2021-41308

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access Control vulnerability in the ReplicationSettings!default.jspa endpoint. The affected versions are before version 8.6.0, fro...

6.5CVSS6.3AI score0.00243EPSS

CVE•added 2019/06/26 4:15 p.m.•69 views

CVE-2019-11583

The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".

6.5CVSS6.4AI score0.00504EPSS

CVE•added 2020/07/01 2:15 a.m.•69 views

CVE-2020-14169

The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability

6.1CVSS5.9AI score0.00334EPSS

CVE•added 2018/01/12 2:29 p.m.•65 views

CVE-2017-14594

The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.

6.1CVSS5.9AI score0.00225EPSS

CVE•added 2018/04/10 1:29 p.m.•64 views

CVE-2017-18101

Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if ...

6.5CVSS6.4AI score0.00384EPSS

CVE•added 2019/08/23 2:15 p.m.•64 views

CVE-2019-11585

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

6.1CVSS6.1AI score0.0025EPSS

CVE•added 2021/08/30 7:15 a.m.•61 views

CVE-2021-39111

The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such a...

6.1CVSS5.8AI score0.00416EPSS

CVE•added 2018/07/16 1:29 p.m.•60 views

CVE-2018-13387

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or...

6.1CVSS5.8AI score0.00203EPSS

CVE•added 2018/10/23 2:0 p.m.•60 views

CVE-2018-13401

The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 b...

6.1CVSS6.1AI score0.00154EPSS

CVE•added 2018/10/23 2:0 p.m.•59 views

CVE-2018-13400

Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12...

6.5CVSS4.8AI score0.00295EPSS

CVE•added 2020/07/01 2:15 a.m.•58 views

CVE-2020-14164

The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.

6.1CVSS6AI score0.00389EPSS

CVE•added 2018/10/23 2:0 p.m.•56 views

CVE-2018-13402

Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version ...

6.1CVSS6.1AI score0.00154EPSS

CVE•added 2018/01/18 6:29 p.m.•55 views

CVE-2017-16863

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.

6.1CVSS5.9AI score0.00203EPSS

CVE•added 2018/04/10 1:29 p.m.•54 views

CVE-2017-18100

The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters.

6.1CVSS5.9AI score0.00173EPSS

CVE•added 2020/07/03 1:15 a.m.•54 views

CVE-2019-20418

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0.

6.5CVSS6.4AI score0.00419EPSS

CVE•added 2020/06/29 6:15 a.m.•52 views

CVE-2019-20410

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 b...

6.5CVSS6.1AI score0.00529EPSS

CVE•added 2018/01/18 2:29 p.m.•51 views

CVE-2017-18033

The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities.

6.5CVSS6.7AI score0.00084EPSS

CVE•added 2018/02/02 2:29 p.m.•51 views

CVE-2017-18039

The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.

6.1CVSS5.7AI score0.00203EPSS

CVE•added 2018/01/12 2:29 p.m.•50 views

CVE-2017-16864

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.

6.1CVSS5.9AI score0.00226EPSS

CVE•added 2018/07/18 2:29 p.m.•50 views

CVE-2018-5232

The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.

6.1CVSS5.9AI score0.00231EPSS

CVE•added 2020/07/13 1:15 a.m.•50 views

CVE-2019-20897

The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.

6.5CVSS6.2AI score0.0083EPSS

CVE•added 2017/01/31 10:59 p.m.•49 views

CVE-2016-6285

Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

6.1CVSS5.9AI score0.00767EPSS

CVE•added 2018/04/06 1:29 p.m.•49 views

CVE-2017-18098

The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields.

6.1CVSS5.9AI score0.00225EPSS

CVE•added 2018/08/28 1:0 p.m.•49 views

CVE-2018-13395

Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or...

6.1CVSS5.9AI score0.00231EPSS

CVE•added 2019/08/23 2:15 p.m.•49 views

CVE-2019-11587

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

6.5CVSS6.4AI score0.00138EPSS

CVE•added 2020/07/13 5:15 a.m.•49 views

CVE-2019-20901

The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.

6.1CVSS6.2AI score0.00421EPSS

CVE•added 2012/05/22 3:55 p.m.•41 views

CVE-2012-2928

The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.

6.4CVSS7.1AI score0.0193EPSS

CVE•added 2009/03/26 9:0 p.m.•37 views

CVE-2008-6531

The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole."

6.8CVSS7.1AI score0.00641EPSS

CVE•added 2009/06/08 7:30 p.m.•37 views

CVE-2008-6832

Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

6.8CVSS7AI score0.00142EPSS