Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
AtlassianJira

21 matches found

CVE
CVE•added 2019/09/11 2:15 p.m.•197 views

CVE-2019-8449

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.

5.3CVSS5.1AI score0.68722EPSS
CVE
CVE•added 2019/08/09 8:15 p.m.•140 views

CVE-2018-20826

The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.

4.3CVSS4.5AI score0.00142EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•139 views

CVE-2019-3403

The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3CVSS5.4AI score0.828EPSS
CVE
CVE•added 2019/08/09 8:15 p.m.•137 views

CVE-2018-20827

The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.

5.4CVSS5.2AI score0.00175EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•135 views

CVE-2019-8442

The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.

7.5CVSS7.2AI score0.92613EPSS
CVE
CVE•added 2019/12/18 4:15 a.m.•113 views

CVE-2019-15013

The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project ...

4.3CVSS4.4AI score0.00287EPSS
CVE
CVE•added 2019/11/08 4:15 a.m.•93 views

CVE-2019-15005

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the ap...

4.3CVSS4.3AI score0.00208EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•91 views

CVE-2019-3402

The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

6.1CVSS5.8AI score0.33441EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•88 views

CVE-2019-11584

The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.

6.1CVSS5.5AI score0.00231EPSS
CVE
CVE•added 2019/05/03 8:29 p.m.•81 views

CVE-2018-20824

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

6.1CVSS5.9AI score0.46129EPSS
CVE
CVE•added 2019/04/30 4:29 p.m.•79 views

CVE-2019-3399

The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.

7.5CVSS7.4AI score0.00573EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•75 views

CVE-2019-11586

The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to create new resolutions via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00138EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•75 views

CVE-2019-3401

The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.

5.3CVSS5.2AI score0.8331EPSS
CVE
CVE•added 2019/06/26 4:15 p.m.•69 views

CVE-2019-11583

The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name".

6.5CVSS6.4AI score0.00504EPSS
CVE
CVE•added 2019/05/22 6:29 p.m.•69 views

CVE-2019-8443

The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenti...

8.1CVSS8AI score0.00783EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•64 views

CVE-2019-11585

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect.

6.1CVSS6.1AI score0.0025EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•58 views

CVE-2018-13404

The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from versi...

4.1CVSS4AI score0.00246EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•58 views

CVE-2019-11588

The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to trigger garbage collection via a Cross-site request forgery (CSRF) vulnerability.

4.3CVSS4.8AI score0.00261EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•53 views

CVE-2018-13403

The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of ...

5.4CVSS5.2AI score0.00173EPSS
CVE
CVE•added 2019/08/23 2:15 p.m.•49 views

CVE-2019-11587

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery (CSRF).

6.5CVSS6.4AI score0.00138EPSS
CVE
CVE•added 2019/02/13 6:29 p.m.•47 views

CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipul...

5.4CVSS5.2AI score0.0018EPSS