CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14180
https://notcve.org/view.php?id=CVE-2020-14180
Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are before version 4.12.0. Las versiones afectadas de Atlassian Jira Service Desk Server y Data Center permiten a atacantes remotos autenticados como usuarios no administradores visualizar Tipos de Peticiones y Descripciones de Proyecto, por medio de una vulnerabilidad de Divulgación de Información en el recurso editform request-type-fields. Las versiones afectadas son las anteriores a 4.12.0 • https://jira.atlassian.com/browse/JSDSERVER-6917 •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-14166 – Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
https://notcve.org/view.php?id=CVE-2020-14166
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file. El recurso /servicedesk/customer/portals en Jira Service Desk Server y Data Center versiones anteriores a 4.10.0, permite a atacantes remotos con privilegios de administrador de proyectos inyectar nombres HTML o JavaScript arbitrarios por medio de una vulnerabilidad de tipo Cross Site Scripting (XSS) mediante la carga de un archivo html Atlassian Jira Service Desk version 4.9.1 suffers from a cross site scripting vulnerability via a file upload. • https://www.exploit-db.com/exploits/49748 http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html https://jira.atlassian.com/browse/JSDSERVER-6895 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2019-15004
https://notcve.org/view.php?id=CVE-2019-15004
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. El componente Customer Context Filter en Atlassian Jira Service Desk Server and Jira Service Desk Data Center versiones anteriores a 3.9.17, versiones desde 3.10.0 anteriores a 3.16.10, de 4.0.0 versiones anteriores a 4.2.6, versiones desde 4.3.0 anteriores a 4.3.5, versiones desde 4.4 .0 anteriores a 4.4.3, y versiones desde 4.5.0 anteriores a 4.5.1, permite a atacantes remotos con acceso al portal visualizar problemas arbitrarios en proyectos de Jira Service Desk mediante una vulnerabilidad de salto de ruta. Note que cuando se habilita la configuración "Anyone can email the service desk or raise a request in the portal", un atacante puede otorgarse acceso al portal, permitiéndole explotar la vulnerabilidad. • http://packetstormsecurity.com/files/155214/Jira-Service-Desk-Server-Data-Center-Path-Traversal.html https://jira.atlassian.com/browse/JSDSERVER-6589 https://seclists.org/bugtraq/2019/Nov/9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2019-15003
https://notcve.org/view.php?id=CVE-2019-15003
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via authorization bypass. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. El componente Customer Context Filter en Atlassian Jira Service Desk Server and Jira Service Desk Data Center versiones anteriores a 3.9.17, versiones desde 3.10.0 anteriores a 3.16.10, de 4.0.0 versiones anteriores a 4.2.6, versiones desde 4.3.0 anteriores a 4.3.5, versiones desde 4.4 .0 anteriores a 4.4.3, y versiones desde 4.5.0 anteriores a 4.5.1, permite a atacantes remotos con acceso al portal visualizar problemas arbitrarios en proyectos de Jira Service Desk mediante una omisión de autorización. Note que cuando se habilita la configuración "Anyone can email the service desk or raise a request in the portal", un atacante puede otorgarse acceso al portal, permitiéndole explotar la vulnerabilidad. • http://packetstormsecurity.com/files/155214/Jira-Service-Desk-Server-Data-Center-Path-Traversal.html https://jira.atlassian.com/browse/JSDSERVER-6590 https://seclists.org/bugtraq/2019/Nov/9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2019-14994
https://notcve.org/view.php?id=CVE-2019-14994
The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and version 4.4.0 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability. El Customer Context Filter en Atlassian Jira Service Desk Server y Jira Service Desk Data Center anterior a versión 3.9.16, desde versión 3.10.0 anterior a versión 3.16.8, desde versión 4.0.0 anterior a versión 4.1.3, desde versión 4.2.0 anterior a versión 4.2.5, desde versión 4.3.0 anterior a versión 4.3.4, y versión 4.4.0, permite a atacantes remotos con acceso al portal visualizar problemas arbitrarios en proyectos de Jira Service Desk por medio de una vulnerabilidad de salto de ruta. Tenga en cuenta que cuando esta habilitada la configuración "Anyone can email the service desk or raise a request in the portal", un atacante puede otorgarse acceso al portal, permitiéndole explotar la vulnerabilidad. • http://packetstormsecurity.com/files/154574/Jira-Service-Desk-Server-And-Data-Center-Path-Traversal.html https://jira.atlassian.com/browse/JSDSERVER-6517 https://samcurry.net/analysis-of-cve-2019-14994 https://seclists.org/bugtraq/2019/Sep/39 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •