CVSS: 5.4EPSS: 0%CPEs: 14EXPL: 0CVE-2018-20239
https://notcve.org/view.php?id=CVE-2018-20239
30 Apr 2019 — Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3... • https://ecosystem.atlassian.net/browse/APL-1373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-13403
https://notcve.org/view.php?id=CVE-2018-13403
13 Feb 2019 — The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard. El gadget de estadísticas de filtro en dos dimensiones en Atlassian Jira, en versiones anteriores a la 7.6.10, desde la versión 7.7.0 hasta antes de la 7.12.4 y d... • https://jira.atlassian.com/browse/JRASERVER-68526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13404
https://notcve.org/view.php?id=CVE-2018-13404
13 Feb 2019 — The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obta... • https://jira.atlassian.com/browse/JRASERVER-68527 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20232
https://notcve.org/view.php?id=CVE-2018-20232
13 Feb 2019 — The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting. El gadget de widget de etiquetas en Atlassian Jira, en versiones anteriores a la 7.6.11 y desde la versión 7.7.0 hasta antes de la 7.13.1, permite que los atacan... • http://www.securityfocus.com/bid/107023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13401
https://notcve.org/view.php?id=CVE-2018-13401
23 Oct 2018 — The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. El recurso XsrfErrorAction en Atlassian Ji... • http://www.securityfocus.com/bid/105751 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13402
https://notcve.org/view.php?id=CVE-2018-13402
23 Oct 2018 — Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability. Muchos recursos en Atl... • http://www.securityfocus.com/bid/105751 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13400
https://notcve.org/view.php?id=CVE-2018-13400
23 Oct 2018 — Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass ... • http://www.securityfocus.com/bid/105751 • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2017-18102
https://notcve.org/view.php?id=CVE-2017-18102
17 Apr 2018 — The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup. El componente review dashboard en atlassian-renderer desde la versión 8.0.0 hasta antes de la versión 8.0.22 permite que atacantes remotos inyecten HTML o JavaScript arbitrario mediante una vulnerabilidad cross-Site Scripting (XSS) en el marcado wiki anidado. • https://jira.atlassian.com/browse/JRASERVER-67108 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •