CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2020-14184
https://notcve.org/view.php?id=CVE-2020-14184
12 Oct 2020 — Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1. Las versiones afectadas de Atlassian Jira Server, permiten a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo Cross-Site Scripting (XSS) en los archivos de exportaci... • https://jira.atlassian.com/browse/JRASERVER-71652 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 4EXPL: 0CVE-2020-14177
https://notcve.org/view.php?id=CVE-2020-14177
21 Sep 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from version 8.6.0 before 8.10.2; and from version 8.11.0 before 8.11.1. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos afectar la disponibilidad de la aplicación por medio de u... • https://jira.atlassian.com/browse/JRASERVER-71388 •
CVSS: 5.3EPSS: 92%CPEs: 4EXPL: 4CVE-2020-14179
https://notcve.org/view.php?id=CVE-2020-14179
21 Sep 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from version 8.6.0 before 8.11.1. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos no autenticados visualizar nombres de campos personalizados y nombres de SLA personalizad... • https://github.com/c0brabaghdad1/CVE-2020-14179 •
CVSS: 5.3EPSS: 94%CPEs: 6EXPL: 7CVE-2020-14181 – Atlassian JIRA 8.11.1 - User Enumeration
https://notcve.org/view.php?id=CVE-2020-14181
17 Sep 2020 — Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, and from version 8.6.0 before 8.12.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten que un usuario no autenticado enumere usuarios por medio de una vulnerabilidad de divulgación de información en el endpoint /ViewUs... • https://packetstorm.news/files/id/181035 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2020-14178
https://notcve.org/view.php?id=CVE-2020-14178
01 Sep 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY endpoint. The affected versions are before version 7.13.7, from version 8.0.0 before 8.5.8, and from version 8.6.0 before 8.12.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos enumerar las claves de proyecto por medio de una vulnerabilidad de Divulgación de Información en el endpoint /br... • https://jira.atlassian.com/browse/JRASERVER-71498 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-20901
https://notcve.org/view.php?id=CVE-2019-20901
13 Jul 2020 — The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter. El recurso login.jsp en Jira versiones anteriores a 8.5.2 y desde versión 8.6.0 anterior a versión 8.6.1, permite a atacantes remotos redireccionar a usuarios hacia un sitio web diferente que pueden usar como parte de un ataque de phishi... • https://jira.atlassian.com/browse/JRASERVER-70408 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-14174
https://notcve.org/view.php?id=CVE-2020-14174
13 Jul 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1. Las versiones afectadas de Atlassian Jira Server y Data Center, permiten a atacantes remotos visualizar títulos de un proyecto privado po... • https://jira.atlassian.com/browse/JRASERVER-71275 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-20900
https://notcve.org/view.php?id=CVE-2019-20900
13 Jul 2020 — Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0. Las versiones afectadas de Atlassian Jira Server y Data Center permiten a atacantes remotos inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross site scripting (XSS) en el módulo Add Field. Las versiones afectadas son anteriores a la versió... • https://jira.atlassian.com/browse/JRASERVER-70858 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0CVE-2019-20899
https://notcve.org/view.php?id=CVE-2019-20899
13 Jul 2020 — The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1. La API Gadget en Atlassian Jira Server y Data Center en las versiones afectadas permite a atacantes remotos hacer que Jira no responda por medio de peticiones repetidas a un determinado endpoint en la API Gadget. Las versiones afectadas ... • https://jira.atlassian.com/browse/JRASERVER-70808 •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2019-20897
https://notcve.org/view.php?id=CVE-2019-20897
13 Jul 2020 — The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1. La funcionalidad avatar upload en las versiones afectadas de Atlassian Jira Server y Data Center permite a atacantes remotos lograr una Denegación de Servicio por medio de un archivo PNG diseñado. Las versiones afectadas son ante... • https://jira.atlassian.com/browse/JRASERVER-70813 • CWE-434: Unrestricted Upload of File with Dangerous Type •