JD
Product
Jira Data Center
On CISA KEVExploited in the wild
80
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 14Medium 61Low 2
Watch
Add Jira Data Center to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-26086 In wildKEV | 5.3 | Aug 16 | Atlassian Jira Server and Data Center Path Traversal Vulnerability Affected: before 8.5.14; 8.6.0 before unspecified; before 8.13.6; 8.14.0 before unspecified; before 8.16.1 |
| CVE-2025-22167 | 6.5 | Oct 22 | This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server Affected: 9.12.0 before 9.12.28; 10.3.0 before 10.3.12; 11.0.0 before 11.1.0 |
| CVE-2024-21685 | 6.5 | Jun 18 | This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center Affected: 9.4.0 before 9.4.21; 9.12.0 before 9.12.8; 9.15.0 before 9.16.0 |
| CVE-2022-26135 | 6.5 | Jun 30 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read… Affected: 8.0.0 before 8.13.22; 8.14.0 before 8.20.10; 8.21.0 before 8.22.4 |
| CVE-2021-43941 | 6.5 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and… Affected: before 8.13.5; 8.14.0 before 8.20.3 |
| CVE-2021-43946 | 6.5 | Jan 5 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a Broken Access Control… Affected: before 8.13.21; 8.14.0 before 8.20.9 |
| CVE-2021-41308 | 6.5 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access… Affected: 8.7.0 before 8.13.12 |
| CVE-2021-39126 | 6.5 | Oct 21 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF) vulnerability, following an… Affected: before 8.5.10; 8.6.0 before 8.13.1 |
| CVE-2019-20897 | 6.5 | Jul 13 | The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file Affected: 8.6.0 before 8.6.2; 8.7.0 before 8.7.1 |
| CVE-2019-20410 | 6.5 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment… Affected: 7.7.0 before 7.13.9; 8.0.0 before 8.4.2 |
| CVE-2022-36801 | 6.1 | Aug 10 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS)… Affected: before 8.20.8 |
| CVE-2021-41304 | 6.1 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability… Affected: 8.14.0 before 8.20.2 |
| CVE-2021-39111 | 6.1 | Aug 30 | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to… Affected: 8.6.0 before 8.13.10; 8.14.0 before 8.18.2 |
| CVE-2021-26080 | 6.1 | Jun 7 | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote… Affected: before 8.5.14; 8.6.0 before 8.13.6; 8.14.0 before 8.16.1 |
| CVE-2021-26079 | 6.1 | Jun 7 | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0… Affected: 8.6.0 before 8.13.7; 8.14.0 before 8.17.0 |
| CVE-2020-36288 | 6.1 | Apr 15 | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |
| CVE-2020-36236 | 6.1 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: 8.6.0 before 8.13.3 |
| CVE-2020-4022 | 6.1 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2020-14168 | 5.9 | Jul 1 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to… Affected: 8.5.0 before 8.5.5; 8.8.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2021-39116 | 5.5 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF… Affected: before 8.13.14; 8.14.0 before 8.19.0 |
| CVE-2021-26083 | 5.4 | Jul 20 | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote… Affected: 8.6.0 before 8.13.6; 8.14.0 before 8.16.1 |
| CVE-2021-26082 | 5.4 | Jul 20 | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers… Affected: 8.6.0 before 8.13.6; 8.14.0 before 8.17.0 |
| CVE-2020-14173 | 5.4 | Jul 3 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: 8.6.0 before 8.6.2; 8.7.0 before 8.7.1 |
| CVE-2020-4024 | 5.4 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20414 | 5.4 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue… Affected: 8.0.0 before 8.4.2 |
| CVE-2020-4021 | 5.4 | Jun 1 | Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: 8.0.0 before 8.5.5; 8.6.0 before 8.8.1 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 7.13.3; 8.0.0 before 8.1.0 |
| CVE-2021-39127 | 5.3 | Oct 21 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC)… Affected: 8.6.0 before 8.13.1 |
| CVE-2021-39122 | 5.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2021-26081 | 5.3 | Jul 20 | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to… Affected: 8.6.0 before 8.13.6; 8.14.0 before 8.16.1 |
| CVE-2020-36289 | 5.3 | May 12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2020-36287 | 5.3 | Apr 9 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version… Affected: 8.14.0 before 8.15.1 |
| CVE-2020-36286 | 5.3 | Apr 1 | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2020-36238 | 5.3 | Apr 1 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2021-26069 | 5.3 | Mar 22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information… Affected: 8.14.0 before 8.15.0 |
| CVE-2020-29453 | 5.3 | Feb 22 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed… Affected: 8.14.0 before 8.15.0 |
| CVE-2020-14179 | 5.3 | Sep 21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure… Affected: before 8.5.8; 8.6.0 before 8.11.1 |
| CVE-2019-20899 | 5.3 | Jul 13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the… Affected: 8.5.5 before 8.6.1; 8.6.2 before 8.7.0 |
| CVE-2019-20412 | 5.3 | Jun 29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper… Affected: 8.0.0 before 8.4.2 |
| CVE-2019-20403 | 5.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure… Affected: 7.13.0 before 8.5.5 |
| CVE-2021-39112 | 4.8 | Aug 25 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project… Affected: 8.6.0 before 8.13.7; 8.14.0 before 8.17.1; 8.18.0 before 8.18.1 |
| CVE-2020-36234 | 4.8 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: 8.14.0 before 8.15.0 |
| CVE-2019-20900 | 4.8 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add… Affected: 8.2.1 before 8.7.0 |
| CVE-2020-4025 | 4.8 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20100 | 4.7 | Feb 12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF) Affected: 7.0.0 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-15002 | 4.3 | Feb 11 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0 Affected: 7.6.4 through 8.1.0 |
| CVE-2021-43952 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery… Affected: before 8.13.18; 8.20.0 before 8.20.6 |
| CVE-2021-41313 | 4.3 | Nov 1 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization… Affected: before 8.20.7 |
| CVE-2021-39121 | 4.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure… Affected: 8.6.0 before 8.13.10; 8.14.0 before 8.18.2 |
| CVE-2021-26075 | 4.3 | Apr 15 | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |