Page 3 of 38 results (0.001 seconds)

CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0

CVE-2020-14178

https://notcve.org/view.php?id=CVE-2020-14178

01 Sep 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos enumerar las claves de proyecto por medio de una vulnerabilidad de Divulgación de Información en el endpoint /br... • https://jira.atlassian.com/browse/JRASERVER-71498 •

CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0

CVE-2020-14174

https://notcve.org/view.php?id=CVE-2020-14174

13 Jul 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos visualizar títulos de un proyecto privado po... • https://jira.atlassian.com/browse/JRASERVER-71275 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-20900

https://notcve.org/view.php?id=CVE-2019-20900

13 Jul 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el módulo Add Field. Las versiones afectadas son anteriores a la versió... • https://jira.atlassian.com/browse/JRASERVER-70858 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0

CVE-2019-20899

https://notcve.org/view.php?id=CVE-2019-20899

13 Jul 2020 — The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1. La API Gadget en Atlassian Jira Server y Data Center en las versiones afectadas permite a atacantes remotos hacer que Jira no responda por medio de peticiones repetidas a un determinado endpoint en la API Gadget. Las versiones afectadas ... • https://jira.atlassian.com/browse/JRASERVER-70808 •

CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 0

CVE-2019-20419

https://notcve.org/view.php?id=CVE-2019-20419

03 Jul 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos ejecutar código arbitrario por medio de una vulnerabilidad de secuestro de DLL en Tomcat. Las versiones afectadas son las versiones anteriores a 8.5.5 y desde la versión 8.6.0 anter... • https://jira.atlassian.com/browse/JRASERVER-70945 • CWE-427: Uncontrolled Search Path Element •

CVSS: 5.9EPSS: 1%CPEs: 8EXPL: 0

CVE-2020-14168

https://notcve.org/view.php?id=CVE-2020-14168

01 Jul 2020 — The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability. El cliente de correo electrónico en Jira Server y Data Center versiones anteriores a 7.13.16, desde versiones 8.5.0 anteriores a 8.5.7, desde versiones 8.8.0 anteriores a 8.8.2 y desde versiones 8.9.0 anteriores a 8.9.1, per... • https://jira.atlassian.com/browse/JRASERVER-71198 •

CVSS: 7.5EPSS: 2%CPEs: 8EXPL: 0

CVE-2020-14167

https://notcve.org/view.php?id=CVE-2020-14167

01 Jul 2020 — The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability. El recurso MessageBundleResource en Jira Server y Data Center versiones anteriores a 7.13.4, desde versiones 8.5.0 anteriores a 8.5.5, desde versiones 8.8.0 anteriores a 8.8.2 y desde versiones 8.9.0 anteriores a 8.9.1, permite a atac... • https://jira.atlassian.com/browse/JRASERVER-71197 •

CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0

CVE-2020-4021

https://notcve.org/view.php?id=CVE-2020-4021

01 Jun 2020 — Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view. Unas versiones afectadas son: versiones anteriores a 8.5.5, y desde versiones 8.6.0 anteriores a 8.8.1 de Atlassian Jira Server y Data Center, permiten a atacantes remotos inyectar HTML o Javascript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (X... • https://jira.atlassian.com/browse/JRASERVER-70923 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2019-20407

https://notcve.org/view.php?id=CVE-2019-20407

17 Mar 2020 — The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check. Se ha identificado una vulnerabilidad en el servidor de aplicaciones SPPA-T3000 (todas las versiones anteriores a la versión Service Pack R8.2 SP2). Un atacante con acceso de red al servidor de aplicaciones podría obtener acceso a registros y archivo... • https://jira.atlassian.com/browse/JRASERVER-70599 • CWE-862: Missing Authorization •

CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 1

CVE-2019-20100

https://notcve.org/view.php?id=CVE-2019-20100

12 Feb 2020 — The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.2, and from version 7.1.0 before version 7.1.3. The vulnerable plugin is used by Atlassian Jira Server and Data Center before version 8.7.0. An attacker could exploit this by tricking an administrative user into making malicious HTTP... • https://ecosystem.atlassian.net/browse/APL-1390 • CWE-352: Cross-Site Request Forgery (CSRF) •