CVSS: 5.3EPSS: 80%CPEs: 2EXPL: 0CVE-2019-3401
https://notcve.org/view.php?id=CVE-2019-3401
22 May 2019 — The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. ManageFilters.jspa resource in Jira antes versión 7.13.3 y desde versión 8.0.0 antes versión 8.1.1, permite a los atacantes remotos enumerar los nombres de usuario mediante una comprobación de autorización incorrecta. • https://jira.atlassian.com/browse/JRASERVER-69244 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3400
https://notcve.org/view.php?id=CVE-2019-3400
03 May 2019 — The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter. El gadget de etiquetas en Jira, en versiones anteriores a 7.13.2 y a partir de la versión 8.0.0 pero antes de la versión 8.0.2, permite a los atacantes remotos inyectar HTML o JavaScript arbitrarios a través de una vulnerabilidad de XSS en el parámetro jql. • http://www.securityfocus.com/bid/108168 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3399
https://notcve.org/view.php?id=CVE-2019-3399
30 Apr 2019 — The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check. El recurso BrowseProjects.jspa en Jira anterior a la versión 7.13.2 y desde la versión 8.0.0 anterior a la versión 8.0.2 permite a los atacantes remotos observar información de proyectos archivados por a una falta de comprobación de autorización. • https://jira.atlassian.com/browse/JRASERVER-69246 • CWE-862: Missing Authorization CWE-863: Incorrect Authorization •
CVSS: 5.4EPSS: 0%CPEs: 14EXPL: 0CVE-2018-20239
https://notcve.org/view.php?id=CVE-2018-20239
30 Apr 2019 — Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3... • https://ecosystem.atlassian.net/browse/APL-1373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2018-13403
https://notcve.org/view.php?id=CVE-2018-13403
13 Feb 2019 — The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard. El gadget de estadísticas de filtro en dos dimensiones en Atlassian Jira, en versiones anteriores a la 7.6.10, desde la versión 7.7.0 hasta antes de la 7.12.4 y d... • https://jira.atlassian.com/browse/JRASERVER-68526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13404
https://notcve.org/view.php?id=CVE-2018-13404
13 Feb 2019 — The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and from version 7.13.0 before version 7.13.1 allows remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obta... • https://jira.atlassian.com/browse/JRASERVER-68527 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20232
https://notcve.org/view.php?id=CVE-2018-20232
13 Feb 2019 — The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting. El gadget de widget de etiquetas en Atlassian Jira, en versiones anteriores a la 7.6.11 y desde la versión 7.7.0 hasta antes de la 7.13.1, permite que los atacan... • http://www.securityfocus.com/bid/107023 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13401
https://notcve.org/view.php?id=CVE-2018-13401
23 Oct 2018 — The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allows remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability. El recurso XsrfErrorAction en Atlassian Ji... • http://www.securityfocus.com/bid/105751 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13402
https://notcve.org/view.php?id=CVE-2018-13402
23 Oct 2018 — Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers to attack users, in some cases be able to obtain a user's Cross-site request forgery (CSRF) token, via a open redirect vulnerability. Muchos recursos en Atl... • http://www.securityfocus.com/bid/105751 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-13400
https://notcve.org/view.php?id=CVE-2018-13400
23 Oct 2018 — Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before version 7.13.1 allow remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate to pass ... • http://www.securityfocus.com/bid/105751 • CWE-269: Improper Privilege Management •