Filtered by vendor Atlassian Subscriptions
Filtered by product Jira Subscriptions
Total 144 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-14164 1 Atlassian 2 Jira, Jira Software Data Center 2024-11-21 6.1 Medium
The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.
CVE-2019-8449 1 Atlassian 1 Jira 2024-11-21 5.3 Medium
The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.
CVE-2019-8443 1 Atlassian 2 Jira, Jira Server 2024-11-21 8.1 High
The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability.
CVE-2019-8442 1 Atlassian 2 Jira, Jira Server 2024-11-21 7.5 High
The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check.
CVE-2019-3403 1 Atlassian 2 Jira, Jira Server 2024-11-21 5.3 Medium
The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVE-2019-3402 1 Atlassian 2 Jira, Jira Server 2024-11-21 N/A
The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.
CVE-2019-3401 1 Atlassian 2 Jira, Jira Server 2024-11-21 5.3 Medium
The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
CVE-2019-3399 1 Atlassian 2 Jira, Jira Server 2024-11-21 7.5 High
The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check.
CVE-2019-20901 1 Atlassian 2 Jira, Jira Server 2024-11-21 6.1 Medium
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVE-2019-20899 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 5.3 Medium
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2019-20898 1 Atlassian 2 Jira, Jira Software Data Center 2024-11-21 7.5 High
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20897 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 6.5 Medium
The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVE-2019-20418 1 Atlassian 2 Jira, Jira Software Data Center 2024-11-21 6.5 Medium
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0.
CVE-2019-20416 1 Atlassian 2 Jira, Jira Software Data Center 2024-11-21 4.8 Medium
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0.
CVE-2019-20415 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 4.3 Medium
Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.3, and from version 8.0.0 before 8.1.0.
CVE-2019-20414 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 5.4 Medium
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20413 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 7.5 High
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20412 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 5.3 Medium
The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper Authentication vulnerability: Workflow names; Project Key, if it is part of the workflow name; Issue Keys; Issue Types; Status Types. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20411 1 Atlassian 3 Jira, Jira Data Center, Jira Server 2024-11-21 4.3 Medium
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20410 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2024-11-21 6.5 Medium
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.