Atlassian
Page 2 of 5 — Atlassian CVEs from a corpus of 472, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41312 | High | 7.5 | 2021-11-03 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and… |
CVE-2021-41310 | Medium | 6.1 | 2021-11-01 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (… |
CVE-2021-41313 | Medium | 4.3 | 2021-11-01 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Imprope… |
CVE-2021-41308 | Medium | 6.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via… |
CVE-2021-41307 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via… |
CVE-2021-41306 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Obj… |
CVE-2021-41305 | High | 7.5 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure D… |
CVE-2021-41304 | Medium | 6.1 | 2021-10-26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (… |
CVE-2021-39127 | Medium | 5.3 | 2021-10-21 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vul… |
CVE-2021-39126 | Medium | 6.5 | 2021-10-21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerabi… |
CVE-2020-18685 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites related to TCP or UDP po… |
CVE-2020-18684 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number. |
CVE-2020-18683 | Critical | 9.8 | 2021-09-30 | Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling. |
CVE-2021-39128 | High | 7.2 | 2021-09-16 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to exe… |
CVE-2021-39125 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability… |
CVE-2021-39124 | Medium | 4.3 | 2021-09-14 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able… |
CVE-2021-39123 | High | 7.5 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Serv… |
CVE-2021-39118 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerab… |
CVE-2019-20101 | Medium | 5.3 | 2021-09-14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability i… |
CVE-2021-39122 | Medium | 5.3 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability i… |
CVE-2021-39121 | Medium | 4.3 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Informati… |
CVE-2021-39116 | Medium | 5.5 | 2021-09-08 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner… |
CVE-2021-39119 | Medium | 5.3 | 2021-09-01 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Ji… |
CVE-2021-39115 | High | 7.2 | 2021-09-01 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Jav… |
CVE-2021-39109 | High | 7.5 | 2021-09-01 | The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerabilit… |
CVE-2021-39117 | Medium | 4.8 | 2021-08-30 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2021-39113 | High | 7.5 | 2021-08-30 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, v… |
CVE-2021-39111 | Medium | 6.1 | 2021-08-30 | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remot… |
CVE-2021-26084 | Critical | 9.8 | 2021-08-30 | In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit… |
CVE-2021-39112 | Medium | 4.8 | 2021-08-25 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability i… |
CVE-2021-26086 | Medium | 5.3 | 2021-08-16 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/w… |
CVE-2021-26085 | Medium | 5.3 | 2021-08-03 | Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability… |
CVE-2021-37843 | Critical | 9.8 | 2021-08-02 | The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e., no other authenti… |
CVE-2017-18113 | High | 8.8 | 2021-08-02 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator… |
CVE-2020-36239 | Critical | 9.8 | 2021-07-29 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Ji… |
CVE-2021-26083 | Medium | 5.4 | 2021-07-20 | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1… |
CVE-2021-26082 | Medium | 5.4 | 2021-07-20 | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 all… |
CVE-2021-26081 | Medium | 5.3 | 2021-07-20 | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows re… |
CVE-2021-26080 | Medium | 6.1 | 2021-06-07 | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1… |
CVE-2021-26079 | Medium | 6.1 | 2021-06-07 | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8… |
CVE-2021-26078 | Medium | 6.1 | 2021-06-07 | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14… |
CVE-2020-36289 | Medium | 5.3 | 2021-05-12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… |
CVE-2021-26077 | High | 8.8 | 2021-05-10 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot… |
CVE-2020-29445 | Medium | 4.3 | 2021-05-07 | Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind ser… |
CVE-2020-29444 | Medium | 5.4 | 2021-05-07 | Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnera… |
CVE-2021-26074 | Medium | 6.5 | 2021-04-16 | Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot pack… |
CVE-2021-26073 | High | 7.7 | 2021-04-16 | Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building A… |
CVE-2021-26076 | Low | 3.7 | 2021-04-15 | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4… |
CVE-2021-26075 | Medium | 4.3 | 2021-04-15 | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from ve… |
CVE-2020-36288 | Medium | 6.1 | 2021-04-15 | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 be… |
CVE-2020-36287 | Medium | 5.3 | 2021-04-09 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14… |
CVE-2021-26072 | Medium | 4.3 | 2021-04-01 | The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal… |
CVE-2021-26071 | Low | 3.5 | 2021-04-01 | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 bef… |
CVE-2020-36286 | Medium | 5.3 | 2021-04-01 | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 befor… |
CVE-2020-36238 | Medium | 5.3 | 2021-04-01 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 befor… |
CVE-2021-26070 | High | 7.2 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken… |
CVE-2021-26069 | Medium | 5.3 | 2021-03-22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an… |
CVE-2020-36240 | Medium | 5.3 | 2021-03-01 | The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbit… |
CVE-2021-26068 | High | 8.8 | 2021-02-22 | An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template… |
CVE-2020-36232 | Medium | 5.0 | 2021-02-22 | The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4.3.2.4, from versio… |
CVE-2020-29453 | Medium | 5.3 | 2021-02-22 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0… |
CVE-2020-29448 | Medium | 5.3 | 2021-02-22 | The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7.4.6, and from 7.5… |
CVE-2020-12873 | High | 8.8 | 2021-02-19 | An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript)… |
CVE-2020-36233 | High | 7.8 | 2021-02-18 | The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 al… |
CVE-2020-29451 | Medium | 4.3 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the… |
CVE-2020-36237 | Medium | 5.3 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vu… |
CVE-2020-36236 | Medium | 6.1 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulne… |
CVE-2020-36235 | Medium | 5.3 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information… |
CVE-2020-36234 | Medium | 4.8 | 2021-02-15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulne… |
CVE-2020-36231 | Medium | 4.3 | 2021-02-02 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure… |
CVE-2020-14192 | Medium | 4.3 | 2021-02-02 | Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerability in the x-asen re… |
CVE-2021-26067 | Medium | 5.3 | 2021-01-28 | Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk an… |
CVE-2020-29450 | Medium | 6.5 | 2021-01-19 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)… |
CVE-2020-29446 | Medium | 5.3 | 2021-01-18 | Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in… |
CVE-2020-29447 | Medium | 4.3 | 2020-12-21 | Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file… |
CVE-2020-14193 | Medium | 5.4 | 2020-11-30 | Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes &… |
CVE-2020-14190 | High | 7.5 | 2020-11-25 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versio… |
CVE-2020-14191 | High | 7.5 | 2020-11-25 | Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in… |
CVE-2020-14189 | Critical | 9.8 | 2020-11-09 | The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of… |
CVE-2020-14188 | Critical | 9.8 | 2020-11-09 | The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the context… |
CVE-2020-14185 | Medium | 5.3 | 2020-10-15 | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations res… |
CVE-2020-14184 | Medium | 5.4 | 2020-10-12 | Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira… |
CVE-2020-14183 | Medium | 4.3 | 2020-10-06 | Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number… |
CVE-2019-20903 | Medium | 5.4 | 2020-10-01 | The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site… |
CVE-2019-20902 | High | 7.5 | 2020-10-01 | Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and from 3.5.0 before 3… |
CVE-2020-14180 | Medium | 4.3 | 2020-09-21 | Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Reques… |
CVE-2020-14179 | Medium | 5.3 | 2020-09-21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Infor… |
CVE-2020-14177 | Medium | 6.5 | 2020-09-21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service… |
CVE-2020-14181 | Medium | 5.3 | 2020-09-17 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… |
CVE-2020-14178 | High | 7.5 | 2020-09-01 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the… |
CVE-2017-18112 | Medium | 6.5 | 2020-08-05 | Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logg… |
CVE-2020-14175 | Medium | 5.4 | 2020-07-24 | Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)… |
CVE-2020-14174 | Medium | 4.3 | 2020-07-13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References… |
CVE-2019-20901 | Medium | 6.1 | 2020-07-13 | The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different websi… |
CVE-2019-20900 | Medium | 4.8 | 2020-07-13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20899 | Medium | 5.3 | 2020-07-13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certa… |
CVE-2019-20898 | High | 7.5 | 2020-07-13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global per… |
CVE-2019-20897 | Medium | 6.5 | 2020-07-13 | The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG… |
CVE-2020-14171 | Medium | 6.5 | 2020-07-09 | Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the… |
CVE-2020-14170 | Medium | 4.3 | 2020-07-09 | Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal network resources via a… |