CVSS: 6.5EPSS: 90%CPEs: 12EXPL: 2CVE-2022-26135
https://notcve.org/view.php?id=CVE-2022-26135
30 Jun 2022 — A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.... • https://github.com/safe3s/CVE-2022-26135 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 93%CPEs: 12EXPL: 1CVE-2022-0540
https://notcve.org/view.php?id=CVE-2022-0540
20 Apr 2022 — A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Una vulnerabilidad en... • https://github.com/Pear1y/CVE-2022-0540-RCE • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43944
https://notcve.org/view.php?id=CVE-2021-43944
08 Mar 2022 — This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Este problema se presenta para documentar q... • https://jira.atlassian.com/browse/JRASERVER-73072 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43945
https://notcve.org/view.php?id=CVE-2021-43945
28 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con permisos de administrador de hojas de ruta inyectar HTML o JavaScript arbitrarios por medio de un... • https://jira.atlassian.com/browse/JRASERVER-73069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43943
https://notcve.org/view.php?id=CVE-2021-43943
24 Feb 2022 — Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0. Las versiones afectadas de Atlassian Jira Service Management Server y Data Center permiten a atacantes con privilegios de administrador inyectar HTML o JavaScript arbitr... • https://jira.atlassian.com/browse/JSDSERVER-10980 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43948
https://notcve.org/view.php?id=CVE-2021-43948
15 Feb 2022 — Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0. Las versiones afectadas de Atlassian Jira Service Management Server y Data Center permiten a atacantes remotos autenticados visualizar los nombres de los objetos privados por medio de una vulnerabilidad de Autorización Impropia en la fu... • https://jira.atlassian.com/browse/JSDSERVER-10981 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43941
https://notcve.org/view.php?id=CVE-2021-43941
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos modificar varios recursos (incluyendo CsvFieldMappingsPage.jspa ... • https://jira.atlassian.com/browse/JRASERVER-73073 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43950
https://notcve.org/view.php?id=CVE-2021-43950
15 Feb 2022 — Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0. Las versiones afectadas de Atlassian Jira Service Management Server y Data Center permiten a atacantes remotos autenticados visualizar la información de configuración de la fuente de importación por medio de una vulnerab... • https://jira.atlassian.com/browse/JSDSERVER-10983 •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43953
https://notcve.org/view.php?id=CVE-2021-43953
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos no autentificados cambiar la configuración de la retención ... • https://jira.atlassian.com/browse/JRASERVER-73170 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43952
https://notcve.org/view.php?id=CVE-2021-43952
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos no autenticados restaurar la configuración por defecto de los campos por medio de una vulnerabilidad de tipo Cross-Site ... • https://jira.atlassian.com/browse/JRASERVER-73138 • CWE-352: Cross-Site Request Forgery (CSRF) •