CVSS: 4.3EPSS: 93%CPEs: 5EXPL: 3CVE-2014-2314 – JIRA Issues Collector - Directory Traversal
https://notcve.org/view.php?id=CVE-2014-2314
Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors. Vulnerabilidad de salto de directorio en el plugin Issue Collector en Atlassian JIRA anterior a 6.0.4 permite a atacantes remotos crear archivos arbitrarios a través de vectores no especificados. • https://www.exploit-db.com/exploits/32725 http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html http://www.exploit-db.com/exploits/32725 https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 2CVE-2013-5319
https://notcve.org/view.php?id=CVE-2013-5319
Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via the name parameter to secure/admin/user/DeleteUser!default.jspa. Vulnerabilidad XSS en secure/admin/user/views/deleteuserconfirm.jspen el panel de administración de Atlassian JIRA anterior a 6.0.5, permite a atacantes remotos inyectar secuencias arbitrarias de comandos web o HTML a través del parámetro "name" en secure/admin/user/DeleteUser!default.jspa. • http://cxsecurity.com/issue/WLB-2013080065 http://packetstormsecurity.com/files/122721 http://secunia.com/advisories/54417 http://www.securityfocus.com/bid/61647 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5151.php https://jira.atlassian.com/browse/JRA/fixforversion/33790 https://jira.atlassian.com/i#browse/JRA-34160 https://jira.atlassian.com/secure/ReleaseNote.jspa?projectId=10240&version=33790 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 58EXPL: 0CVE-2012-2927
https://notcve.org/view.php?id=CVE-2012-2927
The TM Software Tempo plugin before 6.4.3.1, 6.5.x before 6.5.0.2, and 7.x before 7.0.3 for Atlassian JIRA does not properly restrict the capabilities of third-party XML parsers, which allows remote authenticated users to cause a denial of service (resource consumption) via unspecified vectors. El complemento "Software TM Tempo" para Atlassian JIRA antes de v6.4.3.1 , v6.5.x antes de v6.5.0.2 y v7.x antes de v7.0.3 no tiene restringe correctamente las capacidades de los analizadores XML de terceros, lo que permite provocar una denegación de servicio (por excesivo consumo de recursos) a usuarios remotos autenticados a través de vectores no especificados. • http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2012-05-17 http://osvdb.org/81993 http://secunia.com/advisories/49166 http://www.securityfocus.com/bid/53595 https://exchange.xforce.ibmcloud.com/vulnerabilities/75697 • CWE-399: Resource Management Errors •