CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2010-1164
https://notcve.org/view.php?id=CVE-2010-1164
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Atlassian JIRA v3.12 hasta la v4.1. Permiten a usuarios remotos inyectar codigo de script web o código HTML de su elección a través de el parámetro (1) "element" (elemento) o (2) "defaultColor" (color por defecto) a la página de "Colour Picker" (selección de colores); el (3) parámetro "formName", (4) parámetro "element", o (5) campo "full name" (nombre completo) a la página "User Picker" (selección de usuario); el (6) parámetro formName, (7) parámetro "element", o (8) campo "group name" (nombre de grupo) a la página "Group Picker" (selección de grupo); el (9) parámetro announcement_preview_banner_st de componentes sin especificar, relacionados con la página "Announcement Banner Preview" (vista previa de anuncio); vectores sin especificar relacionados con las páginas (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, o (14) cleancommentspam.jsp; el (15) parámetro portletKey de runportleterror.jsp; la (16) URI de issuelinksmall.jsp; el (17) parámetro afterURL de screenshot-redirecter.jsp; o la (18) cabecera HTTP Referrer de 500page.jsp, tal como se ha explotado activamente en Abril del 2010. • http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16 http://jira.atlassian.com/browse/JRA-20994 http://jira.atlassian.com/browse/JRA-21004 http://secunia.com/advisories/39353 http://www.openwall.com/lists/oss-security/2010/04/16/3 http://www.openwall.com/lists/oss-security/2010/04/16/4 http://www.securityfocus.com/bid/39485 https://exchange.xforce.ibmcloud.com/vulnerabilities/57826 https://exchange.xforce.ibmcloud.com/vulnerabilities/57827 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 2%CPEs: 14EXPL: 0CVE-2010-1165
https://notcve.org/view.php?id=CVE-2010-1165
Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010. Atlassian JIRA v3.12 hasta v4.1 permite a administradores autenticados remotamente ejecutar código de su elección modificando(1) adjuntos (como attachments), (2) índice (como indexing), o (3) ruta de guardado y luego subir un fichero, se explota activamente desde abril de 2010. • http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16 http://jira.atlassian.com/browse/JRA-20995 http://jira.atlassian.com/browse/JRA-21004 http://secunia.com/advisories/39353 http://www.openwall.com/lists/oss-security/2010/04/16/3 http://www.openwall.com/lists/oss-security/2010/04/16/4 http://www.securityfocus.com/bid/39485 https://exchange.xforce.ibmcloud.com/vulnerabilities/57828 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-6831
https://notcve.org/view.php?id=CVE-2008-6831
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment"). Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en JIRA Enterprise Edition v3.13 de Atlassian permiten a usuarios remotos inyectar codigo web script o código HTML a través de (1) el parámetro "fullname" (nombre completo) en la página "ViewProfile" (ver perfil) o (2) el parámetro returnUrl en un formulario, como se ha demostrado usando secure/AddComment!default.jspa (añadir comentario). • http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 http://osvdb.org/49415 http://osvdb.org/49416 http://secunia.com/advisories/32113 http://www.securityfocus.com/bid/31967 https://exchange.xforce.ibmcloud.com/vulnerabilities/46167 https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2008-6832
https://notcve.org/view.php?id=CVE-2008-6832
Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Vulnerabilidad de falsificación de petición en sitios cruzados(CSRF) en JIRA Enterprise Edition v3.13 de Atlassian permite a usuarios remotos secuestrar la autenticación de usuarios sin especificar a través de vectores de ataque desconocidos. NOTA: el origen de esta información es desconocido; algunos detalles han sido obtenidos exclusivamente de infomración de terceras partes. • http://osvdb.org/49417 http://secunia.com/advisories/32113 http://www.securityfocus.com/bid/31967 https://exchange.xforce.ibmcloud.com/vulnerabilities/46169 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 0CVE-2008-6531
https://notcve.org/view.php?id=CVE-2008-6531
The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically transformed into method calls, aka "WebWork 1 Parameter Injection Hole." La la aplicación ebWork 1 web framework en Atlassian JIRA v3.13.2, permite a atacantes remotos invocar los métodos públicos de JIRA a través de una URL manipulada en la llamada al método. También conocido como "WebWork 1 Parameter Injection Hole." • http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-12-09 http://secunia.com/advisories/33084 http://www.osvdb.org/52707 http://www.securityfocus.com/bid/32746 https://exchange.xforce.ibmcloud.com/vulnerabilities/47211 • CWE-94: Improper Control of Generation of Code ('Code Injection') •