Atlassian
Page 3 of 5 — Atlassian CVEs from a corpus of 472, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14173 | Medium | 5.4 | 2020-07-03 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cros… |
CVE-2020-14172 | Critical | 9.8 | 2020-07-03 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in w… |
CVE-2019-20419 | High | 7.8 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The af… |
CVE-2019-20418 | Medium | 6.5 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Ser… |
CVE-2020-4029 | Medium | 4.3 | 2020-07-01 | The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 be… |
CVE-2020-4027 | Medium | 4.7 | 2020-07-01 | Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template in… |
CVE-2020-4025 | Medium | 4.8 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5… |
CVE-2020-4024 | Medium | 5.4 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote… |
CVE-2020-4022 | Medium | 6.1 | 2020-07-01 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote… |
CVE-2020-14169 | Medium | 6.1 | 2020-07-01 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Sit… |
CVE-2020-14168 | Medium | 5.9 | 2020-07-01 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows re… |
CVE-2020-14167 | High | 7.5 | 2020-07-01 | The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 befor… |
CVE-2020-14166 | Medium | 4.8 | 2020-07-01 | The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator… |
CVE-2020-14165 | Medium | 5.3 | 2020-07-01 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom… |
CVE-2020-14164 | Medium | 6.1 | 2020-07-01 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cro… |
CVE-2019-20408 | Medium | 5.3 | 2020-07-01 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via… |
CVE-2019-20416 | Medium | 4.8 | 2020-06-30 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20415 | Medium | 4.3 | 2020-06-30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (C… |
CVE-2019-20414 | Medium | 5.4 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulne… |
CVE-2019-20413 | High | 7.5 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner… |
CVE-2019-20412 | Medium | 5.3 | 2020-06-29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information… |
CVE-2019-20411 | Medium | 4.3 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerab… |
CVE-2019-20410 | Medium | 6.5 | 2020-06-29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in… |
CVE-2020-4028 | Medium | 5.3 | 2020-06-23 | Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this m… |
CVE-2019-20409 | Critical | 9.8 | 2020-06-23 | The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code exec… |
CVE-2020-4026 | Medium | 4.3 | 2020-06-03 | The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before… |
CVE-2020-4023 | Medium | 5.4 | 2020-06-01 | The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross… |
CVE-2020-4021 | Medium | 5.4 | 2020-06-01 | Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or Ja… |
CVE-2020-4020 | High | 7.2 | 2020-06-01 | The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Server instance that t… |
CVE-2020-4019 | High | 7.8 | 2020-06-01 | The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place o… |
CVE-2020-4018 | High | 8.8 | 2020-06-01 | The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross-site request forge… |
CVE-2020-4017 | Medium | 5.3 | 2020-06-01 | The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attacke… |
CVE-2020-4016 | Medium | 5.3 | 2020-06-01 | The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to… |
CVE-2020-4015 | Medium | 4.3 | 2020-06-01 | The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via… |
CVE-2020-4014 | Medium | 4.3 | 2020-06-01 | The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's watching settings… |
CVE-2020-4013 | Medium | 5.4 | 2020-06-01 | The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scri… |
CVE-2019-20102 | Medium | 6.1 | 2020-04-22 | The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before version 6.15.5 allows rem… |
CVE-2020-9344 | Medium | 6.1 | 2020-03-20 | Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. |
CVE-2019-20407 | Medium | 4.3 | 2020-03-17 | The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release v… |
CVE-2019-20105 | Medium | 4.9 | 2020-03-17 | The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 b… |
CVE-2012-1500 | Medium | 5.4 | 2020-02-13 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. |
CVE-2019-20100 | Medium | 4.7 | 2020-02-12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21, f… |
CVE-2019-20099 | Medium | 4.3 | 2020-02-12 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSR… |
CVE-2019-20098 | Medium | 4.3 | 2020-02-12 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CS… |
CVE-2019-20406 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local syst… |
CVE-2019-20405 | Medium | 4.3 | 2020-02-06 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a C… |
CVE-2019-20404 | Medium | 4.3 | 2020-02-06 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access… |
CVE-2019-20403 | Medium | 5.3 | 2020-02-06 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an informati… |
CVE-2019-20402 | Medium | 4.9 | 2020-02-06 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user t… |
CVE-2019-20401 | Medium | 6.5 | 2020-02-06 | Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being install… |
CVE-2019-20400 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental var… |
CVE-2019-20106 | Medium | 4.3 | 2020-02-06 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remo… |
CVE-2019-20104 | High | 7.5 | 2020-02-06 | The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perform a Denial of Servi… |
CVE-2019-20097 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from… |
CVE-2019-15012 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6… |
CVE-2019-15010 | High | 8.8 | 2020-01-15 | Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 be… |
CVE-2019-15006 | Medium | 6.5 | 2019-12-19 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was u… |
CVE-2019-15013 | Medium | 4.3 | 2019-12-18 | The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8… |
CVE-2019-15011 | Medium | 4.3 | 2019-12-17 | The ListEntityLinksServlet resource in Application Links before version 5.0.12, from version 5.1.0 before version 5.2.11, from version 5.3.0 before version 5.3… |
CVE-2017-18107 | Medium | 6.5 | 2019-12-17 | Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups… |
CVE-2019-13347 | High | 7.5 | 2019-12-13 | An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence… |
CVE-2019-15009 | Medium | 4.3 | 2019-12-11 | The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove another user's favourite… |
CVE-2019-15008 | Medium | 6.1 | 2019-12-11 | The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScrip… |
CVE-2019-15007 | Medium | 4.8 | 2019-12-11 | The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scri… |
CVE-2019-15005 | Medium | 4.3 | 2019-11-08 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results… |
CVE-2019-15004 | High | 7.5 | 2019-11-07 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 befor… |
CVE-2019-15003 | Medium | 5.3 | 2019-11-07 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from 3.10.0 before 3.16.10, from 4.0.0 befor… |
CVE-2019-15001 | High | 7.2 | 2019-09-19 | The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, fr… |
CVE-2019-15000 | Critical | 9.8 | 2019-09-19 | The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version f… |
CVE-2019-14994 | High | 7.5 | 2019-09-19 | The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3… |
CVE-2019-8451 | Medium | 6.5 | 2019-09-11 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via… |
CVE-2019-8450 | Medium | 4.8 | 2019-09-11 | Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permiss… |
CVE-2019-8449 | Medium | 5.3 | 2019-09-11 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnera… |
CVE-2019-14998 | Medium | 6.5 | 2019-09-11 | The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection vi… |
CVE-2019-14997 | Medium | 4.3 | 2019-09-11 | The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an i… |
CVE-2019-14996 | Medium | 6.1 | 2019-09-11 | The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML… |
CVE-2019-14995 | Medium | 5.3 | 2019-09-11 | The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and… |
CVE-2019-3394 | High | 8.8 | 2019-08-29 | There was a local file disclosure vulnerability in Confluence Server and Confluence Data Center via page exporting. An attacker with permission to editing a pa… |
CVE-2019-8447 | Medium | 4.3 | 2019-08-23 | The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSR… |
CVE-2019-8446 | Medium | 5.3 | 2019-08-23 | The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. |
CVE-2019-8445 | Medium | 5.3 | 2019-08-23 | Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time informati… |
CVE-2019-8444 | Medium | 5.4 | 2019-08-23 | The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaS… |
CVE-2019-14999 | Medium | 4.3 | 2019-08-23 | The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before version 3.0.3 and from version 4.0.0 before… |
CVE-2019-11589 | Medium | 6.1 | 2019-08-23 | The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows… |
CVE-2019-11588 | Medium | 4.3 | 2019-08-23 | The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versi… |
CVE-2019-11587 | Medium | 6.5 | 2019-08-23 | Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versio… |
CVE-2019-11586 | Medium | 4.3 | 2019-08-23 | The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remo… |
CVE-2019-11585 | Medium | 6.1 | 2019-08-23 | The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote atta… |
CVE-2019-11584 | Medium | 6.1 | 2019-08-23 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)… |
CVE-2019-15053 | Medium | 6.8 | 2019-08-14 | The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors… |
CVE-2019-8448 | Medium | 5.3 | 2019-08-13 | The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an informa… |
CVE-2019-11581 | Critical | 9.8 | 2019-08-09 | There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker… |
CVE-2018-20827 | Medium | 5.4 | 2019-08-09 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulner… |
CVE-2018-20826 | Medium | 4.3 | 2019-08-09 | The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation c… |
CVE-2019-13990 | Critical | 9.8 | 2019-07-26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. |
CVE-2019-11583 | Medium | 6.5 | 2019-06-26 | The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue… |
CVE-2019-11582 | High | 8.8 | 2019-06-14 | An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote… |
CVE-2019-3397 | Critical | 9.1 | 2019-06-03 | Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x), from 5.14.0 before 5.14.4 (fixed… |
CVE-2019-11580 | Critical | 9.8 | 2019-06-03 | Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or au… |
CVE-2019-8443 | High | 8.1 | 2019-05-22 | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote att… |