CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39119
https://notcve.org/view.php?id=CVE-2021-39119
01 Sep 2021 — Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is revoked, via a Broken Access Control vulnerability in the issue notification feature. The affected versions are before version 8.19.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a usuarios que han observado un problema sigan recibiendo actualizaciones sobre la misma incluso después de que su cuenta de Jira se... • https://jira.atlassian.com/browse/JRASERVER-72737 • CWE-863: Incorrect Authorization •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39117
https://notcve.org/view.php?id=CVE-2021-39117
30 Aug 2021 — The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field. La página AssociateFieldToScreens en Atlassian Jira Server y Data Center versiones anteriores a 8.18.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) por medio del nombre de un campo pers... • https://jira.atlassian.com/browse/JRASERVER-72597 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-39113
https://notcve.org/view.php?id=CVE-2021-39113
30 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0. Unas versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos seguir visualizando el contenido en caché incluso después de perder los permisos, por medio de u... • https://jira.atlassian.com/browse/JRASERVER-72573 • CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2017-18113
https://notcve.org/view.php?id=CVE-2017-18113
02 Aug 2021 — The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and o... • https://jira.atlassian.com/browse/JRASERVER-72660 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 3CVE-2021-26078 – Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-26078
07 Jun 2021 — The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. El componente number range searcher en Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versiones 8.6.0 anteriores a versiones 8.13.6, y desde versiones 8.14.0 versiones anteriores a 8.16.1 permite a at... • https://packetstorm.news/files/id/163289 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 67%CPEs: 4EXPL: 1CVE-2020-36287
https://notcve.org/view.php?id=CVE-2020-36287
09 Apr 2021 — The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. El recurso de preferencia de gadgets del panel de control del plugin de gadgets de Atlassian usado en Jira Server y Jira Data Center versiones anteriores a 8.13.5, y desde versión 8.14.0 anterior a 8.15.1, permite a atacantes r... • https://github.com/f4rber/CVE-2020-36287 • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 3%CPEs: 6EXPL: 0CVE-2021-26069
https://notcve.org/view.php?id=CVE-2021-26069
22 Mar 2021 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. Versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos no autenticados descargar archivos t... • https://jira.atlassian.com/browse/JRASERVER-72010 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-26070
https://notcve.org/view.php?id=CVE-2021-26070
22 Mar 2021 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1. Versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos evadir una protección detrás del firewall de los recursos app-linked por medio de una vulnerabilidad de Auten... • https://jira.atlassian.com/browse/JRASERVER-72029 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 0CVE-2020-36232
https://notcve.org/view.php?id=CVE-2020-36232
22 Feb 2021 — The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from version 4.4.0 before 4.4.12, and from version 5.0.0 before 5.0.1 allowed unexpected DNS lookups and requests to arbitrary services as it incorrectly obtained application base url information from the executing http request which could be attacker controlled. La clase MessageBundleWhiteList de atlassian-gadgets versiones anteriores a 4.2.37, desde versiones ... • https://jira.atlassian.com/browse/JRASERVER-72025 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 85%CPEs: 6EXPL: 0CVE-2020-29453
https://notcve.org/view.php?id=CVE-2020-29453
18 Feb 2021 — The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. La clase CachingResourceDownloadRewriteRule en Jira Server y Jira Data Center versiones anteriores a 8.5.11, desde 8.6.0 anteriores a 8.13.3 y desde 8.14.0 anteriores a 8.15.0, permitía a atacantes remotos no au... • https://jira.atlassian.com/browse/JRASERVER-72014 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •