CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8448
https://notcve.org/view.php?id=CVE-2019-8448
The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability. El dispositivo login.jsp en Jira anterior de la versión 7.13.4 y desde la versión 8.0.0 anterior de la versión 8.2.2 permite a los atacantes remotos enumerar nombres de usuario a través de una vulnerabilidad de divulgación de información. • https://jira.atlassian.com/browse/JRASERVER-69797 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20826
https://notcve.org/view.php?id=CVE-2018-20826
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check. El recurso rest inline-create en Jira anterior a versión 7.12.3, permite a los atacantes remotos autenticados configurar al reportero en problemas por medio de una falta de comprobación de autorización. • https://jira.atlassian.com/browse/JRASERVER-69239 • CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20827
https://notcve.org/view.php?id=CVE-2018-20827
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter. El gadget activity stream en Jira anterior a versión 7.13.1 permite a los atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el parámetro country. • https://jira.atlassian.com/browse/JRASERVER-69237 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 180EXPL: 0CVE-2019-13990 – libquartz: XXE attacks via job description
https://notcve.org/view.php?id=CVE-2019-13990
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. La función initDocumentParser en el archivo xml/XMLSchedulingDataProcessor.java en Quartz Scheduler de Terracotta hasta la versión 2.3.0, permite ataques de tipo XXE por medio de una descripción del trabajo. The Terracotta Quartz Scheduler is susceptible to an XML external entity attack (XXE) through a job description. This issue stems from inadequate handling of XML external entity (XXE) declarations in the initDocumentParser function within xml/XMLSchedulingDataProcessor.java. By enticing a victim to access a maliciously crafted job description (containing XML content), a remote attacker could exploit this vulnerability to execute an XXE attack on the targeted system. • https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html https://github.com/quartz-scheduler/quartz/issues/467 https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E https://lists.apache.org/thread.html/6b6e3480b19856365fb5e • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 97%CPEs: 5EXPL: 3CVE-2019-11581 – Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-11581
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability. Se presentó una vulnerabilidad de inyección de plantilla en el lado del servidor en Jira Server y Data Center, en las acciones ContactAdministrators y SendBulkMail. Un atacante puede ejecutar código remotamente sobre sistemas que ejecutan una versión vulnerable de Jira Server o Data Center. • https://github.com/jas502n/CVE-2019-11581 https://github.com/kobs0N/CVE-2019-11581 https://github.com/PetrusViet/CVE-2019-11581 https://jira.atlassian.com/browse/JRASERVER-69532 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •