CVSS: 9.8EPSS: 21%CPEs: 12EXPL: 1CVE-2022-0540
https://notcve.org/view.php?id=CVE-2022-0540
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0. Una vulnerabilidad en Jira Seraph permite a un atacante remoto no autenticado omitir la autenticación mediante el envío de una petición HTTP especialmente diseñada. Esto afecta a Atlassian Jira Server y Data Center versiones anteriores a 8.13.18, versiones 8.14.0 y posteriores anteriores a 8.20.6, y versiones 8.21.0 y posteriores anteriores a 8.22.0. • https://github.com/Pear1y/CVE-2022-0540-RCE https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20 https://jira.atlassian.com/browse/JRASERVER-73650 https://jira.atlassian.com/browse/JSDSERVER-11224 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43944
https://notcve.org/view.php?id=CVE-2021-43944
This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Este problema se presenta para documentar que ha sido implementado una mejora de seguridad en la forma en que Jira Server y Data Center usan las plantillas. Las versiones afectadas de Atlassian Jira Server y Data Center permitían a atacantes remotos con permisos de administrador del sistema ejecutar código arbitrario por medio de la inyección de plantillas que conllevaba a una Ejecución de Código Remota (RCE) en la funcionalidad Email Templates. • https://jira.atlassian.com/browse/JRASERVER-73072 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43945
https://notcve.org/view.php?id=CVE-2021-43945
Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con permisos de administrador de hojas de ruta inyectar HTML o JavaScript arbitrarios por medio de una vulnerabilidad de tipo Cross-Site Scripting (SXSS) Almacenado en el endpoint /rest/jpo/1.0/hierarchyConfiguration. Las versiones afectadas son anteriores a versión 8.20.3. • https://jira.atlassian.com/browse/JRASERVER-73069 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43943
https://notcve.org/view.php?id=CVE-2021-43943
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0. Las versiones afectadas de Atlassian Jira Service Management Server y Data Center permiten a atacantes con privilegios de administrador inyectar HTML o JavaScript arbitrarios por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) en el campo "Object Schema" del archivo /secure/admin/InsightDefaultCustomFieldConfig.jspa. Las versiones afectadas son anteriores a la versión 4.21.0 • https://jira.atlassian.com/browse/JSDSERVER-10980 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-43948
https://notcve.org/view.php?id=CVE-2021-43948
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0. Las versiones afectadas de Atlassian Jira Service Management Server y Data Center permiten a atacantes remotos autenticados visualizar los nombres de los objetos privados por medio de una vulnerabilidad de Autorización Impropia en la funcionalidad "Move objects". Las versiones afectadas son anteriores a versión 4.21.0 • https://jira.atlassian.com/browse/JSDSERVER-10981 •