Page 4 of 53 results (0.004 seconds)

CVSS: 4.3EPSS: 1%CPEs: 2EXPL: 0

CVE-2019-20405

https://notcve.org/view.php?id=CVE-2019-20405

06 Feb 2020 — The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability. El flag de monitoreo JMX en Atlassian Jira Server and Data Center antes de la versión 8.6.0, permite a atacantes remotos activar o desactivar el flag de monitoreo JMX por medio de una vulnerabilidad de tipo cross-site request forgery (CSRF). • https://jira.atlassian.com/browse/JRASERVER-70570 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 2%CPEs: 4EXPL: 0

CVE-2019-20404

https://notcve.org/view.php?id=CVE-2019-20404

06 Feb 2020 — The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. La API en Atlassian Jira Server y Data Center antes de la versión 8.6.0, permite a atacantes remotos autenticados determinar los títulos de proyectos a los que no tienen acceso por medio de una vulnerabilidad de autorización inapropiada. • https://jira.atlassian.com/browse/JRASERVER-70569 •

CVSS: 5.3EPSS: 2%CPEs: 2EXPL: 0

CVE-2019-20403

https://notcve.org/view.php?id=CVE-2019-20403

06 Feb 2020 — The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability. La API en Atlassian Jira Server y Data Center antes de la versión 8.6.0, permite a atacantes remotos determinar si una clave de proyecto Jira existe o no por medio de una vulnerabilidad de divulgación de información. • https://jira.atlassian.com/browse/JRASERVER-70565 •

CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-20401

https://notcve.org/view.php?id=CVE-2019-20401

06 Feb 2020 — Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities. Varios recursos de configuración de instalación en Jira antes de la versión 8.5.2, permiten a atacantes remotos configurar una instancia de Jira, que aún no ha terminado de ser instalada, por medio de vulnerabilidades de tipo cross-site request forgery (CSRF). • https://jira.atlassian.com/browse/JRASERVER-70406 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-20400

https://notcve.org/view.php?id=CVE-2019-20400

06 Feb 2020 — The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. El uso de Tomcat en Jira antes de la versión 8.5.2, permite a atacantes locales con permiso para escribir un archivo dll en un directorio en la variable de entorno global path puede inyectar código por medio de una vulnerabilidad de secuestro de DLL. • https://jira.atlassian.com/browse/JRASERVER-70407 • CWE-427: Uncontrolled Search Path Element •

CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 0

CVE-2019-20106

https://notcve.org/view.php?id=CVE-2019-20106

06 Feb 2020 — Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug. Las propiedades de comentarios en Atlassian Jira Server y Data Center antes de la versión 7.13.12, desde versión 8.0.0 antes de la versión 8.5.4 y versión 8.6.0 antes de la versión 8.6.1, permiten a atacantes remotos hacer coment... • https://jira.atlassian.com/browse/JRASERVER-70543 • CWE-276: Incorrect Default Permissions •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

CVE-2019-15013

https://notcve.org/view.php?id=CVE-2019-15013

18 Dec 2019 — The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check. El método removeStatus de la clase WorkflowResource en Jira versiones anteriores a la versión 7.13.12, desde la versión 8.0.0 anteriores a la versión 8.4.3 y desde la versión 8.5... • https://jira.atlassian.com/browse/JRASERVER-70405 • CWE-862: Missing Authorization •

CVSS: 9.0EPSS: 23%CPEs: 12EXPL: 0

CVE-2019-15001 – Jira Server / Data Center Template Injection

https://notcve.org/view.php?id=CVE-2019-15001

19 Sep 2019 — The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request. El plugin Jira Importers en Atlassian Jira Server y Data Cente desde la versión 7.0.10 anterior a 7.6.16, desde ... • http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.5EPSS: 94%CPEs: 1EXPL: 4

CVE-2019-8451

https://notcve.org/view.php?id=CVE-2019-8451

11 Sep 2019 — The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. El recurso /plugins/servlet/gadgets/makeRequest en Jira versiones anteriores a 8.4.0, permite a atacantes remotos acceder al contenido de recursos de la red interna por medio de una vulnerabilidad de tipo Server Side Request Forgery (SSRF) debido a un err... • https://github.com/jas502n/CVE-2019-8451 • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-8450

https://notcve.org/view.php?id=CVE-2019-8450

11 Sep 2019 — Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field. Varias plantillas del plugin Optimization en Jira versiones anteriores a 7.13.6, y desde la versión 8.0.0 anteriores a 8.4.0, permiten a atacantes remotos, que tienen permiso para administrar campos personali... • https://jira.atlassian.com/browse/JRASERVER-69795 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •