Atlassian Jira Server
99 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2019-15002 | unspecified – < 8.1.0 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a | MEDIUM 4.3 | 0.3 % | ||
| CVE-2022-36801 | unspecified – < 8.20.8 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref | MEDIUM 6.1 | 67 % | ||
| CVE-2022-36799 | unspecified – < 8.13.19 ; 8.14.0 – < unspecified ; unspecified – < 8.20.7 ; … | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af | HIGH 7.2 | 47 % | ||
| CVE-2021-43944 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af | HIGH 7.2 | 2.3 % | ||
| CVE-2021-43945 | unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrar | MEDIUM 4.8 | 0.6 % | ||
| CVE-2021-43941 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPag | MEDIUM 6.5 | 0.6 % | ||
| CVE-2021-43953 | unspecified – < 8.13.16 ; next of 8.14.0 – < unspecified ; unspecified – < 8.20.5 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo | MEDIUM 4.3 | 0.5 % | ||
| CVE-2021-43952 | unspecified – < 8.21.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fi | MEDIUM 4.3 | 0.4 % | ||
| CVE-2021-43947 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code vi | HIGH 7.2 | 4.3 % | ||
| CVE-2021-43946 | unspecified – < 8.13.21 ; 8.14.0 – < unspecified ; unspecified – < 8.20.9 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscr | MEDIUM 6.5 | 1.2 % | ||
| CVE-2021-43942 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro | MEDIUM 6.1 | 55 % | ||
| CVE-2021-41311 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access r | HIGH 7.5 | 0.9 % | ||
| CVE-2021-41309 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export a | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-41312 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Manage | HIGH 7.5 | 1.2 % | ||
| CVE-2021-41310 | unspecified – < 8.5.19 ; 8.6.0 – < unspecified ; unspecified – < 8.13.11 ; … | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-41313 | unspecified – < 8.20.7 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurat | MEDIUM 4.3 | 0.9 % | ||
| CVE-2021-41308 | unspecified – < 8.6.0 ; 8.7.0 – < unspecified ; unspecified – < 8.13.12 ; … | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Repli | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-41307 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and | HIGH 7.5 | 1.7 % | ||
| CVE-2021-41306 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.0 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an | HIGH 7.5 | 1.6 % | ||
| CVE-2021-41305 | unspecified – < 8.13.12 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filter | HIGH 7.5 | 1.2 % | ||
| CVE-2021-41304 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.2 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-39126 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forge | MEDIUM 6.5 | 0.7 % | ||
| CVE-2021-39127 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-39128 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administr | HIGH 7.2 | 2.6 % | ||
| CVE-2021-39125 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumer | MEDIUM 5.3 | 1.9 % | ||
| CVE-2019-20101 | unspecified – < 8.13.3 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Cont | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-39118 | unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an e | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-39123 | unspecified – < 8.16.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability v | HIGH 7.5 | 1.6 % | ||
| CVE-2021-39124 | unspecified – < 8.16.0 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote att | MEDIUM 4.3 | 0.5 % | ||
| CVE-2021-39122 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclos | MEDIUM 5.3 | 1.9 % | ||
| CVE-2021-39121 | unspecified – < 8.5.18 ; 8.6.0 – < unspecified ; unspecified – < 8.13.10 ; … | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projec | MEDIUM 4.3 | 1.6 % | ||
| CVE-2021-39116 | unspecified – < 8.13.14 ; 8.14.0 – < unspecified ; unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S | MEDIUM 5.5 | 1.5 % | ||
| CVE-2021-39119 | unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-39117 | unspecified – < 8.18.0 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary | MEDIUM 4.8 | 0.6 % | ||
| CVE-2021-39113 | unspecified – < 8.13.9 ; 8.14.0 – < unspecified ; unspecified – < 8.18.0 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after lo | HIGH 7.5 | 2.5 % | ||
| CVE-2021-39111 | unspecified – < 8.5.18 ; 8.6.0 – < unspecified ; unspecified – < 8.13.10 ; … | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before | MEDIUM 6.1 | 1.3 % | ||
| CVE-2021-39112 | unspecified – < 8.5.15 ; 8.6.0 – < unspecified ; unspecified – < 8.13.7 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp | MEDIUM 4.8 | 1.0 % | ||
| CVE-2021-26086 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit | MEDIUM 5.3 | 100 % | KEV | |
| CVE-2017-18113 | unspecified – < 8.18.1 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a sy | HIGH 8.8 | 1.8 % | ||
| CVE-2021-26083 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8 | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-26082 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14. | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-26081 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 befo | MEDIUM 5.3 | 1.2 % | ||
| CVE-2021-26079 | unspecified – < 8.5.15 ; 8.6.0 – < unspecified ; unspecified – < 8.13.7 ; … | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, | MEDIUM 6.1 | 1.2 % | ||
| CVE-2021-26080 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8. | MEDIUM 6.1 | 1.3 % | ||
| CVE-2021-26078 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and | MEDIUM 6.1 | 4.0 % | ||
| CVE-2020-36289 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu | MEDIUM 5.3 | 99 % | ||
| CVE-2021-26076 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 befo | LOW 3.7 | 1.2 % | ||
| CVE-2021-26075 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before | MEDIUM 4.3 | 1.6 % | ||
| CVE-2020-36288 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and fro | MEDIUM 6.1 | 1.5 % | ||
| CVE-2020-36287 | unspecified – < 8.13.5 ; 8.14.0 – < unspecified ; unspecified – < 8.15.1 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, an | MEDIUM 5.3 | 9.0 % | ||
| CVE-2020-36286 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v | MEDIUM 5.3 | 1.5 % | ||
| CVE-2021-26071 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from | LOW 3.5 | 0.5 % | ||
| CVE-2020-36238 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v | MEDIUM 5.3 | 1.6 % | ||
| CVE-2021-26069 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate | MEDIUM 5.3 | 2.7 % | ||
| CVE-2021-26070 | unspecified – < 8.13.3 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked reso | HIGH 7.2 | 1.9 % | ||
| CVE-2020-29453 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8 | MEDIUM 5.3 | 20 % | ||
| CVE-2020-29451 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure v | MEDIUM 4.3 | 0.9 % | ||
| CVE-2020-36234 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc | MEDIUM 4.8 | 1.1 % | ||
| CVE-2020-36237 | unspecified – < 8.15.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Inform | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-36236 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc | MEDIUM 6.1 | 1.3 % | ||
| CVE-2020-36235 | unspecified – < 8.13.2 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names | MEDIUM 5.3 | 2.0 % | ||
| CVE-2020-36231 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access | MEDIUM 4.3 | 1.2 % | ||
| CVE-2020-14185 | unspecified – < 7.13.18 ; 8.0.0 – < unspecified ; 8.6.0 – < unspecified ; … | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the Actio | MEDIUM 5.3 | 1.9 % | ||
| CVE-2020-14184 | unspecified – < 8.5.9 ; 8.6.0 – < unspecified ; unspecified – < 8.12.3 ; … | Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vu | MEDIUM 5.4 | 0.9 % | ||
| CVE-2020-14183 | unspecified – < 7.13.18 ; 8.0.0 – < unspecified ; unspecified – < 8.5.9 ; … | Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support | MEDIUM 4.3 | 1.3 % | ||
| CVE-2020-14177 | unspecified – < 7.13.6 ; 7.14.0 – < unspecified ; unspecified – < 8.5.7 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based | MEDIUM 6.5 | 2.2 % | ||
| CVE-2020-14179 | unspecified – < 8.5.8 ; 8.6.0 – < unspecified ; unspecified – < 8.11.1 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA | MEDIUM 5.3 | 76 % | ||
| CVE-2020-14181 | unspecified – < 7.13.6 ; 8.0.0 – < unspecified ; unspecified – < 8.5.7 ; … | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu | MEDIUM 5.3 | 100 % | ||
| CVE-2020-14178 | unspecified – < 7.13.17 ; 8.0.0 – < unspecified ; unspecified – < 8.5.8 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vu | HIGH 7.5 | 3.1 % | ||
| CVE-2019-20901 | unspecified – < 8.5.2 ; 8.6.0 – < unspecified ; unspecified – < 8.6.1 | The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users t | MEDIUM 6.1 | 1.2 % | ||
| CVE-2020-14174 | unspecified – < 7.13.6 ; 8.0.0 – < unspecified ; unspecified – < 8.5.7 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct | MEDIUM 4.3 | 1.2 % | ||
| CVE-2019-20900 | unspecified – < 8.7.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc | MEDIUM 4.8 | 0.9 % | ||
| CVE-2019-20899 | unspecified – < 8.5.4 ; 8.6.0 – < unspecified ; unspecified – < 8.6.1 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated | MEDIUM 5.3 | 2.1 % | ||
| CVE-2019-20898 | unspecified – < 8.8.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticate | HIGH 7.5 | 1.3 % | ||
| CVE-2019-20897 | unspecified – < 8.5.4 ; 8.6.0 – < unspecified ; unspecified – < 8.6.2 ; … | The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service | MEDIUM 6.5 | 1.9 % | ||
| CVE-2020-14173 | unspecified – < 8.5.4 ; 8.6.0 – < unspecified ; unspecified – < 8.6.2 ; … | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or Ja | MEDIUM 5.4 | 0.9 % | ||
| CVE-2020-14172 | unspecified – < 7.13.0 ; 8.0.0 – < unspecified ; unspecified – < 8.5.0 ; … | This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implem | CRITICAL 9.8 | 2.5 % | ||
| CVE-2019-20419 | unspecified – < 8.5.5 ; 8.6.0 – < unspecified ; unspecified – < 8.7.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerabilit | HIGH 7.8 | 0.8 % | ||
| CVE-2019-20418 | unspecified – < 8.8.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Applic | MEDIUM 6.5 | 1.0 % | ||
| CVE-2019-20408 | unspecified – < 8.7.0 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal net | MEDIUM 5.3 | 1.0 % | ||
| CVE-2019-20416 | unspecified – < 8.3.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc | MEDIUM 4.8 | 0.6 % | ||
| CVE-2019-20415 | unspecified – < 7.13.3 ; 8.0.0 – < unspecified ; unspecified – < 8.1.0 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site | MEDIUM 4.3 | 0.6 % | ||
| CVE-2019-20414 | unspecified – < 7.13.9 ; 8.0.0 – < unspecified ; unspecified – < 8.4.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc | MEDIUM 5.4 | 1.0 % | ||
| CVE-2019-20413 | unspecified – < 7.13.9 ; 8.0.0 – < unspecified ; unspecified – < 8.4.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S | HIGH 7.5 | 2.1 % | ||
| CVE-2019-20412 | unspecified – < 7.13.9 ; 8.0.0 – < unspecified ; unspecified – < 8.4.2 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the fol | MEDIUM 5.3 | 1.9 % | ||
| CVE-2019-20411 | unspecified – < 7.13.9 ; 8.0.0 – < unspecified ; unspecified – < 8.4.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forg | MEDIUM 4.3 | 0.7 % | ||
| CVE-2019-20410 | unspecified – < 7.6.17 ; 7.7.0 – < unspecified ; unspecified – < 7.13.9 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosur | MEDIUM 6.5 | 1.9 % | ||
| CVE-2019-20409 | unspecified – < 8.8.0 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to ga | CRITICAL 9.8 | 2.5 % | ||
| CVE-2019-20100 | unspecified – < 8.7.0 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions | MEDIUM 4.7 | 1.0 % | ||
| CVE-2019-20099 | unspecified – < 8.7.0 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site r | MEDIUM 4.3 | 0.7 % | ||
| CVE-2019-20098 | unspecified – < 8.7.0 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site | MEDIUM 4.3 | 0.8 % | ||
| CVE-2019-20405 | unspecified – < 8.6.0 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring fla | MEDIUM 4.3 | 0.6 % | ||
| CVE-2019-20404 | unspecified – < 8.6.0 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they | MEDIUM 4.3 | 1.3 % | ||
| CVE-2019-20403 | unspecified – < 8.6.0 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or n | MEDIUM 5.3 | 1.5 % | ||
| CVE-2019-20402 | unspecified – < 8.6.0 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without r | MEDIUM 4.9 | 0.8 % | ||
| CVE-2019-20401 | unspecified – < 8.5.2 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet fin | MEDIUM 6.5 | 0.8 % | ||
| CVE-2019-20400 | unspecified – < 8.5.2 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global pat | HIGH 7.8 | 0.4 % | ||
| CVE-2019-15005 | unspecified – < 8.3.2 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans an | MEDIUM 4.3 | 1.3 % | ||
| CVE-2019-15001 | 7.0.10 – < unspecified ; unspecified – < 7.6.16 ; 7.7.0 – < unspecified ; … | The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0 | HIGH 7.2 | 11 % |