Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Jira
(Atlassian)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 143 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-06-30 | CVE-2019-20416 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0. | Jira, Jira_software_data_center | N/A | ||
| 2020-06-23 | CVE-2019-20409 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability. | Jira, Jira_software_data_center | N/A | ||
| 2020-02-13 | CVE-2012-1500 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. | Greenhopper, Jira | N/A | ||
| 2019-11-08 | CVE-2019-15005 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into. A vulnerable version of the plugin is included with Bitbucket Server / Data Center before 6.6.0, Confluence Server / Data Center before 7.0.1, Jira... | Bamboo, Bitbucket, Confluence, Crowd, Crucible, Fisheye, Jira, Troubleshooting_and_support | N/A | ||
| 2019-08-23 | CVE-2019-11584 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority. | Jira | 6.1 | ||
| 2019-08-09 | CVE-2018-20827 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter. | Jira | 5.4 | ||
| 2019-06-26 | CVE-2019-11583 | The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name". | Jira | 6.5 | ||
| 2019-05-03 | CVE-2018-20824 | The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter. | Jira | 6.1 | ||
| 2018-02-02 | CVE-2017-18039 | The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter. | Jira | 6.1 | ||
| 2017-04-10 | CVE-2017-5983 | The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. | Jira | 9.8 |