CVSS: 5.3EPSS: 86%CPEs: 1EXPL: 1CVE-2019-8446
https://notcve.org/view.php?id=CVE-2019-8446
23 Aug 2019 — The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. El recurso / rest / issueNav / 1 / issueTable en Jira antes de la versión 8.3.2 permite a los atacantes remotos enumerar nombres de usuario mediante una verificación de autorización incorrecta. • https://jira.atlassian.com/browse/JRASERVER-69777 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 1%CPEs: 2EXPL: 0CVE-2019-8445
https://notcve.org/view.php?id=CVE-2019-8445
23 Aug 2019 — Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check. Varios recursos de descanso del registro de trabajo en Jira antes de la versión 7.13.7, y desde la versión 8.0.0 antes de la versión 8.3.2 permiten a los atacantes remotos ver la información del tiempo del registro de trabajo a través de una verificación de permisos en espera • https://jira.atlassian.com/browse/JRASERVER-69778 • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8444
https://notcve.org/view.php?id=CVE-2019-8444
23 Aug 2019 — The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification. l componente wikirenderer en Jira antes de la versión 7.13.6 y desde la versión 8.0.0 antes de la versión 8.3.2 permite a los atacantes remotos inyectar HTML o JavaScript arbitrario a través de una vulnerabilidad de secuencias de comandos de sitios cruzados (XSS) en... • https://jira.atlassian.com/browse/JRASERVER-69779 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-11589
https://notcve.org/view.php?id=CVE-2019-11589
23 Aug 2019 — The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability. El recurso ChangeSharedFilterOwner en Jira antes de la versión 7.13.6, de la versión 8.0.0 antes de la versión 8.2.3, y de la versión 8.3.0 antes de la versión 8.3.2 permite que los atacantes remotos a... • https://jira.atlassian.com/browse/JRASERVER-69780 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-8448
https://notcve.org/view.php?id=CVE-2019-8448
13 Aug 2019 — The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure vulnerability. El dispositivo login.jsp en Jira anterior de la versión 7.13.4 y desde la versión 8.0.0 anterior de la versión 8.2.2 permite a los atacantes remotos enumerar nombres de usuario a través de una vulnerabilidad de divulgación de información. • https://jira.atlassian.com/browse/JRASERVER-69797 •
CVSS: 9.8EPSS: 94%CPEs: 5EXPL: 3CVE-2019-11581 – Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability
https://notcve.org/view.php?id=CVE-2019-11581
23 Jul 2019 — There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability. Se presentó una vulnerabilidad de iny... • https://github.com/jas502n/CVE-2019-11581 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3400
https://notcve.org/view.php?id=CVE-2019-3400
03 May 2019 — The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter. El gadget de etiquetas en Jira, en versiones anteriores a 7.13.2 y a partir de la versión 8.0.0 pero antes de la versión 8.0.2, permite a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de XSS en el parámetro jql. • http://www.securityfocus.com/bid/108168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 14EXPL: 0CVE-2018-20239
https://notcve.org/view.php?id=CVE-2018-20239
30 Apr 2019 — Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3... • https://ecosystem.atlassian.net/browse/APL-1373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-13403
https://notcve.org/view.php?id=CVE-2018-13403
13 Feb 2019 — The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard. El gadget de estadísticas de filtro en dos dimensiones en Atlassian Jira, en versiones anteriores a la 7.6.10, desde la versión 7.7.0 hasta antes de la 7.12.4 y d... • https://jira.atlassian.com/browse/JRASERVER-68526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13404
https://notcve.org/view.php?id=CVE-2018-13404
13 Feb 2019 — The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obta... • https://jira.atlassian.com/browse/JRASERVER-68527 • CWE-918: Server-Side Request Forgery (SSRF) •