Vulnerabilities (CVE)

Filtered by vendor Atlassian Subscribe
Filtered by product Jira Server
Total 131 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-14174 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 4.0 MEDIUM 4.3 MEDIUM
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.
CVE-2019-20414 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 3.5 LOW 5.4 MEDIUM
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2020-4021 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 3.5 LOW 5.4 MEDIUM
Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.
CVE-2019-20897 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 4.0 MEDIUM 6.5 MEDIUM
The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVE-2019-20899 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 5.0 MEDIUM 5.3 MEDIUM
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2020-4029 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 4.0 MEDIUM 4.3 MEDIUM
The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.
CVE-2020-4025 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 3.5 LOW 4.8 MEDIUM
The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.
CVE-2020-4024 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 3.5 LOW 5.4 MEDIUM
The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.
CVE-2020-14167 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.
CVE-2019-20901 1 Atlassian 2 Jira, Jira Server 2023-12-10 5.8 MEDIUM 6.1 MEDIUM
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVE-2019-20419 1 Atlassian 2 Jira Data Center, Jira Server 2023-12-10 4.4 MEDIUM 7.8 HIGH
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2.
CVE-2019-20407 1 Atlassian 2 Jira Data Center, Jira Server 2023-12-10 4.0 MEDIUM 4.3 MEDIUM
The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.
CVE-2019-20900 1 Atlassian 2 Jira Data Center, Jira Server 2023-12-10 3.5 LOW 4.8 MEDIUM
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.
CVE-2019-20410 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 4.0 MEDIUM 6.5 MEDIUM
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20411 1 Atlassian 3 Jira, Jira Data Center, Jira Server 2023-12-10 4.3 MEDIUM 4.3 MEDIUM
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2020-14168 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 4.3 MEDIUM 5.9 MEDIUM
The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.
CVE-2020-14173 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 3.5 LOW 5.4 MEDIUM
The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVE-2019-20413 1 Atlassian 4 Jira, Jira Data Center, Jira Server and 1 more 2023-12-10 5.0 MEDIUM 7.5 HIGH
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the UserPickerBrowser.jspa page. The affected versions are before version 7.13.9, and from version 8.0.0 before 8.4.2.
CVE-2019-20403 1 Atlassian 2 Jira Data Center, Jira Server 2023-12-10 5.0 MEDIUM 5.3 MEDIUM
The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability.
CVE-2019-20400 1 Atlassian 1 Jira Server 2023-12-10 4.4 MEDIUM 7.8 HIGH
The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability.