Product:

Jira

(Atlassian)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 143
Date Id Summary Products Score Patch Annotated
2020-07-01 CVE-2020-14165 The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. Jira, Jira_software_data_center 5.3
2020-07-13 CVE-2019-20898 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0. Jira, Jira_software_data_center 7.5
2021-02-15 CVE-2020-36237 Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0. Data_center, Jira 5.3
2020-10-06 CVE-2020-14183 Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1. Jira 4.3
2020-07-01 CVE-2020-14164 The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. Jira, Jira_software_data_center N/A
2020-02-06 CVE-2019-20402 Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. Jira, Jira_software_data_center N/A
2020-07-01 CVE-2020-14169 The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability Jira, Jira_software_data_center N/A
2020-07-03 CVE-2019-20418 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0. Jira, Jira_software_data_center N/A
2020-06-23 CVE-2020-4028 Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability. Jira, Jira_software_data_center N/A
2020-07-01 CVE-2019-20408 The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. Jira N/A