CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39122
https://notcve.org/view.php?id=CVE-2021-39122
08 Sep 2021 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the /rest/api/2/search endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos visualizar los correos electrónicos de los usuarios por medio de una vulnerabilidad de divulgac... • https://jira.atlassian.com/browse/JRASERVER-72293 •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39121
https://notcve.org/view.php?id=CVE-2021-39121
08 Sep 2021 — Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos autenticados enumerar las claves de los proyectos privad... • https://jira.atlassian.com/browse/JRASERVER-72715 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39119
https://notcve.org/view.php?id=CVE-2021-39119
01 Sep 2021 — Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a usuarios que han observado un problema sigan recibiendo actualizaciones sobre la misma incluso después de que su cuenta de Jira se... • https://jira.atlassian.com/browse/JRASERVER-72737 • CWE-863: Incorrect Authorization •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39117
https://notcve.org/view.php?id=CVE-2021-39117
30 Aug 2021 — The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field. La página AssociateFieldToScreens en Atlassian Jira Server y Data Center versiones anteriores a 8.18.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) por medio del nombre de un campo pers... • https://jira.atlassian.com/browse/JRASERVER-72597 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 0CVE-2021-39113
https://notcve.org/view.php?id=CVE-2021-39113
30 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0. Unas versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos seguir visualizando el contenido en caché incluso después de perder los permisos, por medio de u... • https://jira.atlassian.com/browse/JRASERVER-72573 • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39111
https://notcve.org/view.php?id=CVE-2021-39111
30 Aug 2021 — The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field. El plugin Editor en Atlassian Jira Server y Data Center versiones anteriores a 8.5.18, desde versiones 8.6.0 anteriores a 8.13.10, y desde versi... • https://jira.atlassian.com/browse/JRASERVER-72716 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2021-39112
https://notcve.org/view.php?id=CVE-2021-39112
25 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos redirigir a usuarios a una URL maliciosa por medio de una vulnerabilida... • https://jira.atlassian.com/browse/JRASERVER-72433 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE-1022: Use of Web Link to Untrusted Target with window.opener Access •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-18113
https://notcve.org/view.php?id=CVE-2017-18113
02 Aug 2021 — The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and o... • https://jira.atlassian.com/browse/JRASERVER-72660 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26083
https://notcve.org/view.php?id=CVE-2021-26083
20 Jul 2021 — Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. Una exportación de Informes HTML en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.16.1, permite a atacantes remotos inyectar HTML o Java... • https://jira.atlassian.com/browse/JRASERVER-72213 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26082
https://notcve.org/view.php?id=CVE-2021-26082
20 Jul 2021 — The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability. Una Exportación XML en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.17.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrari... • https://jira.atlassian.com/browse/JRASERVER-72393 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •