CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-39116
https://notcve.org/view.php?id=CVE-2021-39116
08 Sep 2021 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF Image Reader component. The affected versions are before version 8.13.14, and from version 8.14.0 before 8.19.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos impactar en la disponibilidad de la aplicación a través de una vulnerabilidad de denegación de servicio (DoS) en el component... • https://jira.atlassian.com/browse/JRASERVER-72738 •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 0CVE-2021-39113
https://notcve.org/view.php?id=CVE-2021-39113
30 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0. Unas versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos anónimos seguir visualizando el contenido en caché incluso después de perder los permisos, por medio de u... • https://jira.atlassian.com/browse/JRASERVER-72573 • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39111
https://notcve.org/view.php?id=CVE-2021-39111
30 Aug 2021 — The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field. El plugin Editor en Atlassian Jira Server y Data Center versiones anteriores a 8.5.18, desde versiones 8.6.0 anteriores a 8.13.10, y desde versi... • https://jira.atlassian.com/browse/JRASERVER-72716 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 0CVE-2021-39112
https://notcve.org/view.php?id=CVE-2021-39112
25 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos redirigir a usuarios a una URL maliciosa por medio de una vulnerabilida... • https://jira.atlassian.com/browse/JRASERVER-72433 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE-1022: Use of Web Link to Untrusted Target with window.opener Access •
CVSS: 5.3EPSS: 97%CPEs: 6EXPL: 5CVE-2021-26086 – Atlassian Jira Server and Data Center Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2021-26086
16 Aug 2021 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos leer archivos particulares por medio de una vulnerabilidad de salto de ruta en el endpoint /WEB-INF/web.xml. Las versione... • https://packetstorm.news/files/id/164405 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26083
https://notcve.org/view.php?id=CVE-2021-26083
20 Jul 2021 — Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. Una exportación de Informes HTML en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.16.1, permite a atacantes remotos inyectar HTML o Java... • https://jira.atlassian.com/browse/JRASERVER-72213 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26082
https://notcve.org/view.php?id=CVE-2021-26082
20 Jul 2021 — The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability. Una Exportación XML en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.17.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrari... • https://jira.atlassian.com/browse/JRASERVER-72393 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26081
https://notcve.org/view.php?id=CVE-2021-26081
20 Jul 2021 — REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint. Una API REST en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.16.1, permite a atacantes remotos enumerar nom... • https://jira.atlassian.com/browse/JRASERVER-72499 •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26079
https://notcve.org/view.php?id=CVE-2021-26079
07 Jun 2021 — The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. El componente CardLayoutConfigTable en Jira Server y Jira Data Center versiones anteriores a 8.5.15, y desde versiones 8.6.0 anteriores a versiones 8.13.7, y desde versiones 8.14.0v anteriores a 8.17.0, permite a atacantes... • https://jira.atlassian.com/browse/JRASERVER-72396 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26080
https://notcve.org/view.php?id=CVE-2021-26080
07 Jun 2021 — EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. El archivo EditworkflowScheme.jspa en Jira Server y Jira Data Center versiones anteriores a 8.5.14, y desde versiones 8.6.0 anteriores a versiones 8.13.6, y desde versiones 8.14.0 anteriores a 8.16.1, permite a atacantes remotos inyectar HTML... • https://jira.atlassian.com/browse/JRASERVER-72432 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •