CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43941
https://notcve.org/view.php?id=CVE-2021-43941
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and ImporterValueMappingsPage.jspa) via a Cross-Site Request Forgery (CSRF) vulnerability in the jira-importers-plugin. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos modificar varios recursos (incluyendo CsvFieldMappingsPage.jspa ... • https://jira.atlassian.com/browse/JRASERVER-73073 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-43940
https://notcve.org/view.php?id=CVE-2021-43940
15 Feb 2022 — Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a DLL Hijacking vulnerability in the Confluence installer. This vulnerability only affects installations of Confluence Server and Data Center on Windows. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Las versiones afectadas de Atlassian Confluence Server y Data Center permiten a los atacantes locales autentificado... • https://jira.atlassian.com/browse/CONFSERVER-66550 • CWE-427: Uncontrolled Search Path Element •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43953
https://notcve.org/view.php?id=CVE-2021-43953
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos no autentificados cambiar la configuración de la retención ... • https://jira.atlassian.com/browse/JRASERVER-73170 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43952
https://notcve.org/view.php?id=CVE-2021-43952
15 Feb 2022 — Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos no autenticados restaurar la configuración por defecto de los campos por medio de una vulnerabilidad de tipo Cross-Site ... • https://jira.atlassian.com/browse/JRASERVER-73138 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43947
https://notcve.org/view.php?id=CVE-2021-43947
06 Jan 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE) vulnerability in the Email Templates feature. This issue bypasses the fix of https://jira.atlassian.com/browse/JSDSERVER-8665. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos con privilegios de administrador... • https://jira.atlassian.com/browse/JRASERVER-73067 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43946
https://notcve.org/view.php?id=CVE-2021-43946
05 Jan 2022 — Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control vulnerability in the /secure/EditSubscription.jspa endpoint. The affected versions are before version 8.13.21, and from version 8.14.0 before 8.20.9. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a los atacantes remotos autenticados añadir grupos de administradores para filtrar suscripciones a través de una v... • https://jira.atlassian.com/browse/JRASERVER-73071 •
CVSS: 6.1EPSS: 8%CPEs: 2EXPL: 0CVE-2021-43942
https://notcve.org/view.php?id=CVE-2021-43942
04 Jan 2022 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos inyectar H... • https://jira.atlassian.com/browse/JRASERVER-73068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41311
https://notcve.org/view.php?id=CVE-2021-41311
08 Dec 2021 — Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify projects' Users & Roles settings, via a Broken Authentication vulnerability in the /plugins/servlet/project-config/PROJECT/roles endpoint. The affected versions are before version 8.19.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes con acceso a una cuenta de administrador a la que le es revocado el acceso, modific... • https://jira.atlassian.com/browse/JRASERVER-72802 • CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41309
https://notcve.org/view.php?id=CVE-2021-41309
08 Dec 2021 — Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The affected versions of Jira Server and Data Center are before version 8.19.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten que un usuario al que le es revocado el acceso a Jira Service Managem... • https://jira.atlassian.com/browse/JRASERVER-72803 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41312
https://notcve.org/view.php?id=CVE-2021-41312
03 Nov 2021 — Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue Collectors on Jira Service Management projects via an Improper Authentication vulnerability in the /secure/ViewCollectors endpoint. The affected versions are before version 8.19.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a un atacante remoto al que le ha sido revocado el acceso a Jira Service Management ha... • https://jira.atlassian.com/browse/JRASERVER-72801 • CWE-287: Improper Authentication •