CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26082
https://notcve.org/view.php?id=CVE-2021-26082
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability. Una Exportación XML en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.17.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenado • https://jira.atlassian.com/browse/JRASERVER-72393 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26081
https://notcve.org/view.php?id=CVE-2021-26081
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint. Una API REST en Atlassian Jira Server y Jira Data Center versiones anteriores a 8.5.14, desde versión 8.6.0 anteriores a 8.13.6, y desde versión 8.14.0 anteriores a 8.16.1, permite a atacantes remotos enumerar nombres de usuario por medio de una vulnerabilidad de Exposición de Datos Confidenciales en el endpoint "/rest/api/latest/user/avatar/temporary" • https://jira.atlassian.com/browse/JRASERVER-72499 •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26079
https://notcve.org/view.php?id=CVE-2021-26079
The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. El componente CardLayoutConfigTable en Jira Server y Jira Data Center versiones anteriores a 8.5.15, y desde versiones 8.6.0 anteriores a versiones 8.13.7, y desde versiones 8.14.0v anteriores a 8.17.0, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) • https://jira.atlassian.com/browse/JRASERVER-72396 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-26080
https://notcve.org/view.php?id=CVE-2021-26080
EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. El archivo EditworkflowScheme.jspa en Jira Server y Jira Data Center versiones anteriores a 8.5.14, y desde versiones 8.6.0 anteriores a versiones 8.13.6, y desde versiones 8.14.0 anteriores a 8.16.1, permite a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) • https://jira.atlassian.com/browse/JRASERVER-72432 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 96%CPEs: 6EXPL: 0CVE-2020-36289
https://notcve.org/view.php?id=CVE-2020-36289
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a un usuario no autenticado enumerar usuarios a través de una vulnerabilidad de divulgación de información en el endpoint QueryComponentRendererValue!Default.jspa. • https://jira.atlassian.com/browse/JRASERVER-71559 • CWE-863: Incorrect Authorization •