Atlassian Jira Server And Data Center vulnerabilities
15 vulnerabilities
Known vulnerabilities in Atlassian Jira Server And Data Center, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2021-43942atlassian · jira_data_center +2 moreatlassian jira_data_centerAffected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3.CVSS6.1MediumEPSS55.36%RoutineCVE-2020-4029atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.CVSS4.3MediumEPSS1.45%RoutineCVE-2020-4025atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.CVSS4.8MediumEPSS0.92%RoutineCVE-2020-4024atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.CVSS5.4MediumEPSS0.93%RoutineCVE-2020-4022atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.CVSS6.1MediumEPSS1.14%RoutineCVE-2020-14169atlassian · jira_server_and_data_center +2 moreatlassian jira_server_and_data_centerThe quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerabilityCVSS6.1MediumEPSS0.77%RoutineCVE-2020-14168atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.CVSS5.9MediumEPSS1.68%PrioritiseCVE-2020-14167atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerThe MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.CVSS7.5HighEPSS2.13%RoutineCVE-2020-14165atlassian · jira_server_and_data_center +2 moreatlassian jira_server_and_data_centerThe UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability.CVSS5.3MediumEPSS1.00%RoutineCVE-2020-14164atlassian · jira_server_and_data_center +2 moreatlassian jira_server_and_data_centerThe WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.CVSS6.1MediumEPSS0.73%RoutineCVE-2020-4028atlassian · jira_server_and_data_center +2 moreatlassian jira_server_and_data_centerVersions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability.CVSS5.3MediumEPSS0.86%RoutineCVE-2020-4021atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerAffected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.CVSS5.4MediumEPSS1.00%RoutineCVE-2019-20105atlassian · application_links +1 moreatlassian application_linksThe EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.CVSS4.9MediumEPSS1.49%RoutineCVE-2019-20106atlassian · jira_server_and_data_center +4 moreatlassian jira_server_and_data_centerComment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug.CVSS4.3MediumEPSS1.14%Act nowCVE-2019-11581Atlassian · Jira Server and Data Center +1 moreAtlassian Jira Server and Data Center Server-Side Template Injection VulnerabilityThere was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.CVSS9.8CriticalKEVEPSS84.62%