Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Jira
(Atlassian)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 143 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2021-09-14 | CVE-2021-39118 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the /rest/api/1.0/render endpoint. The affected versions are before version 8.19.0. | Data_center, Jira | 5.3 | ||
2021-08-30 | CVE-2021-39117 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field. | Data_center, Jira | 4.8 | ||
2021-08-02 | CVE-2017-18113 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into... | Data_center, Jira | 8.8 | ||
2020-07-01 | CVE-2020-14165 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. | Jira, Jira_software_data_center | 5.3 | ||
2020-07-13 | CVE-2019-20898 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0. | Jira, Jira_software_data_center | 7.5 | ||
2021-02-15 | CVE-2020-36237 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0. | Data_center, Jira | 5.3 | ||
2020-10-06 | CVE-2020-14183 | Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1. | Jira | 4.3 | ||
2020-07-01 | CVE-2020-14164 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. | Jira, Jira_software_data_center | N/A | ||
2020-02-06 | CVE-2019-20402 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. | Jira, Jira_software_data_center | N/A | ||
2020-07-01 | CVE-2020-14169 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability | Jira, Jira_software_data_center | N/A |