Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Jira
(Atlassian)Repositories |
Unknown: This might be proprietary software. |
#Vulnerabilities | 143 |
Date | Id | Summary | Products | Score | Patch | Annotated |
---|---|---|---|---|---|---|
2020-07-01 | CVE-2020-14169 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability | Jira, Jira_software_data_center | N/A | ||
2020-07-03 | CVE-2019-20418 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0. | Jira, Jira_software_data_center | N/A | ||
2020-06-23 | CVE-2020-4028 | Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability. | Jira, Jira_software_data_center | N/A | ||
2020-07-01 | CVE-2019-20408 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | Jira | N/A | ||
2020-06-30 | CVE-2019-20416 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0. | Jira, Jira_software_data_center | N/A | ||
2020-06-23 | CVE-2019-20409 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability. | Jira, Jira_software_data_center | N/A | ||
2020-02-13 | CVE-2012-1500 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. | Greenhopper, Jira | N/A | ||
2019-11-08 | CVE-2019-15005 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira... | Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira, Troubleshooting_and_support | N/A | ||
2019-08-23 | CVE-2019-11584 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority. | Jira | 6.1 | ||
2019-08-09 | CVE-2018-20827 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter. | Jira | 5.4 |