JD
Product
Jira Data Center
On CISA KEVExploited in the wild
80
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 14Medium 61Low 2
Watch
Add Jira Data Center to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-36238 | 5.3 | Apr 1 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2021-26069 | 5.3 | Mar 22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information… Affected: 8.14.0 before 8.15.0 |
| CVE-2020-29453 | 5.3 | Feb 22 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed… Affected: 8.14.0 before 8.15.0 |
| CVE-2020-14179 | 5.3 | Sep 21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure… Affected: before 8.5.8; 8.6.0 before 8.11.1 |
| CVE-2019-20899 | 5.3 | Jul 13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the… Affected: 8.5.5 before 8.6.1; 8.6.2 before 8.7.0 |
| CVE-2019-20412 | 5.3 | Jun 29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper… Affected: 8.0.0 before 8.4.2 |
| CVE-2019-20403 | 5.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure… Affected: 7.13.0 before 8.5.5 |
| CVE-2021-39112 | 4.8 | Aug 25 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project… Affected: 8.6.0 before 8.13.7; 8.14.0 before 8.17.1; 8.18.0 before 8.18.1 |
| CVE-2020-36234 | 4.8 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: 8.14.0 before 8.15.0 |
| CVE-2019-20900 | 4.8 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add… Affected: 8.2.1 before 8.7.0 |
| CVE-2020-4025 | 4.8 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20100 | 4.7 | Feb 12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF) Affected: 7.0.0 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-15002 | 4.3 | Feb 11 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0 Affected: 7.6.4 through 8.1.0 |
| CVE-2021-43952 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery… Affected: before 8.13.18; 8.20.0 before 8.20.6 |
| CVE-2021-41313 | 4.3 | Nov 1 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization… Affected: before 8.20.7 |
| CVE-2021-39121 | 4.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure… Affected: 8.6.0 before 8.13.10; 8.14.0 before 8.18.2 |
| CVE-2021-26075 | 4.3 | Apr 15 | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |
| CVE-2020-36231 | 4.3 | Feb 2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object… Affected: 8.6.0 before 8.13.2; 8.13.3 |
| CVE-2020-14174 | 4.3 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability… Affected: 8.0.0 before 8.5.7; 8.6.0 before 8.9.2; 8.10.0 |
| CVE-2020-4029 | 4.3 | Jul 1 | The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows… Affected: 8.6.0 before 8.7.2; 8.8.0 before 8.8.1 |
| CVE-2019-20415 | 4.3 | Jun 30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability Affected: 8.0.0 before 8.1.0 |
| CVE-2019-20411 | 4.3 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability Affected: 7.7.0 before 7.13.9; 8.0.0 before 8.4.2 |
| CVE-2019-20407 | 4.3 | Mar 17 | The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information… Affected: 8.4.1 before 8.5.3; 8.5.4 before 8.6.1; after 8.6.2 before 8.7.0 |
| CVE-2019-20099 | 4.3 | Feb 12 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF) Affected: 7.6.15 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-20098 | 4.3 | Feb 12 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF) Affected: 7.6.15 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-20405 | 4.3 | Feb 6 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request… Affected: 7.13.0 before 8.6.0 |
| CVE-2019-20404 | 4.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper… Affected: 8.2.4 before 8.6.0; 8.6.1 before 8.7.0 |
| CVE-2019-20106 | 4.3 | Feb 6 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make… Affected: 8.0.0 before 8.5.4; 8.6.0 |
| CVE-2021-26076 | 3.7 | Apr 15 | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |
| CVE-2021-26071 | 3.5 | Apr 1 | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |