Page 3 of 28 results (0.009 seconds)

CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0

CVE-2020-4022

https://notcve.org/view.php?id=CVE-2020-4022

01 Jul 2020 — The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type. El recurso de descarga de archivos adjuntos en Atlassian Jira Server y Data Center versiones anteriores a 8.5.5, y desde versiones 8.6.0 anteriores a 8.8.2, y desde versiones 8.9.0 anteriores a 8.9.1, p... • https://jira.atlassian.com/browse/JRASERVER-71107 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-14169

https://notcve.org/view.php?id=CVE-2020-14169

01 Jul 2020 — The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability El componente quick search en Atlassian Jira Server y Data Center versiones anteriores a 8.9.1, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) • https://jira.atlassian.com/browse/JRASERVER-71205 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-14165

https://notcve.org/view.php?id=CVE-2020-14165

01 Jul 2020 — The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. El recurso UniversalAvatarResource.getAvatars en Jira Server and Data Center versiones anteriores a 8.9.0, permite a atacantes remotos obtener información sobre nombres de avatars de proyectos personalizados por medio de una vulnerabilidad de autorización inapropiada • https://jira.atlassian.com/browse/JRASERVER-71185 •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-14164

https://notcve.org/view.php?id=CVE-2020-14164

01 Jul 2020 — The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. El recurso del editor WYSIWYG en Jira Server and Data Center versiones anteriores a 8.8.2, permite a atacantes remotos inyectar nombres HTML o JavaScript arbitrarios por medio de una vulnerabilidad de tipo Cross Site Scripting (XSS) al pegar un código javascript en... • https://jira.atlassian.com/browse/JRASERVER-71184 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-20416

https://notcve.org/view.php?id=CVE-2019-20416

30 Jun 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. The affected versions are before version 8.3.0. Las versiones afectadas del servidor y centro de datos Atlassian Jira permiten a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de escritura en sitios cruzados (XSS) en la característica de configuración del proye... • https://jira.atlassian.com/browse/JRASERVER-70856 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2020-4028

https://notcve.org/view.php?id=CVE-2020-4028

23 Jun 2020 — Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability. En versiones anteriores a 8.9.1, varios recursos en Jira respondieron con un 404 en lugar de redireccionar a los usuarios no autenticados a la página de inicio de sesión, en algunas situaciones esto puede haber permiti... • https://jira.atlassian.com/browse/JRASERVER-71175 • CWE-203: Observable Discrepancy •

CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0

CVE-2019-20409

https://notcve.org/view.php?id=CVE-2019-20409

23 Jun 2020 — The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability. La manera en que las plantillas de velocidad se usaron en Atlassian Jira Server y Data Center anteriores a la versión 8.8.0, permitió a atacantes remotos obtener una ejecución de código remota, si eran capaces de explotar una vulnerabilidad de inyección de plantillas de... • https://jira.atlassian.com/browse/JRASERVER-70944 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-20402

https://notcve.org/view.php?id=CVE-2019-20402

06 Feb 2020 — Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. Los archivos zip de soporte en Atlassian Jira Server y Data Center antes de que la versión 8.6.0, pudieran ser descargados por un usuario del Administrador de Sistema sin requerir que el usuario reingrese su contraseña por medio de una vulnerabilidad de autorización inapropiada. • https://jira.atlassian.com/browse/JRASERVER-70564 •