CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-20419
https://notcve.org/view.php?id=CVE-2019-20419
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos ejecutar código arbitrario por medio de una vulnerabilidad de secuestro de DLL en Tomcat. Las versiones afectadas son las versiones anteriores a 8.5.5 y desde la versión 8.6.0 anteriores a 8.7.2 • https://jira.atlassian.com/browse/JRASERVER-70945 • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-20410
https://notcve.org/view.php?id=CVE-2019-20410
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment restriction feature. The affected versions are before version 7.6.17, from version 7.7.0 before 7.13.9, and from version 8.0.0 before 8.4.2. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos visualizar información confidencial por medio de una vulnerabilidad de divulgación de información en la funcionalidad de restricción de comentarios. Las versiones afectadas son anteriores a la versión 7.6.17, desde la versión 7.7.0 anteriores a 7.13.9, y desde la versión 8.0.0 anteriores a 8.4.2 • https://jira.atlassian.com/browse/JRASERVER-70884 •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2019-20099
https://notcve.org/view.php?id=CVE-2019-20099
The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present. El componte VerifyPopServerConnection!add.jspa en Atlassian Jira Server and Data Center anterior a versión 8.7.0, es vulnerable a un ataque de tipo cross-site request forgery (CSRF). • https://jira.atlassian.com/browse/JRASERVER-70606 https://www.tenable.com/security/research/tra-2020-05 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2019-20098
https://notcve.org/view.php?id=CVE-2019-20098
The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). An attacker could exploit this by tricking an administrative user into making malicious HTTP requests, allowing the attacker to enumerate hosts and open ports on the internal network where Jira server is present. El componente VerifySmtpServerConnection!add.jspa en Atlassian Jira Server and Data Center anterior a versión 8.7.0, es vulnerable a un ataque de tipo cross-site request forgery (CSRF). • https://jira.atlassian.com/browse/JRASERVER-70605 https://www.tenable.com/security/research/tra-2020-05 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-20405
https://notcve.org/view.php?id=CVE-2019-20405
The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability. El flag de monitoreo JMX en Atlassian Jira Server and Data Center antes de la versión 8.6.0, permite a atacantes remotos activar o desactivar el flag de monitoreo JMX por medio de una vulnerabilidad de tipo cross-site request forgery (CSRF). • https://jira.atlassian.com/browse/JRASERVER-70570 • CWE-352: Cross-Site Request Forgery (CSRF) •