JS
Product
Jira Service Management
On CISA KEVExploited in the wild
17
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 4Medium 8Low 0
Watch
Add Jira Service Management to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-21589 In wildKEV | 7.5 | Oct 5 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Affected: 4.14.0 before 5.12.40; 5.13.0 before 10.3.26; 10.4.0 before 11.3.12 |
| CVE-2022-26136 | 9.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps Affected: 4.14.0 before 4.20.10; 4.14.0 before 4.20.10; 4.21.0 before 4.22.4; 4.21.0 before 4.22.4 |
| CVE-2022-0540 | 9.8 | Apr 20 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request Affected: before 4.13.8; before 4.13.18; 4.14.0 before 4.20.6; 4.14.0 before 4.20.6; 4.21.0 before 4.22.0; 4.21.0 before 4.22.0 |
| CVE-2020-36239 | 9.8 | Jul 29 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service… Affected: 4.14.0 before 4.17.0 |
| CVE-2019-13990 | 9.8 | Jul 26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description Affected: 4.20.0; 4.20.0; 4.20.1; 4.20.1; 4.20.2; 4.20.2; +34 more |
| CVE-2023-22501 | 9.1 | Feb 1 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira… Affected: 5.3.0 before 5.3.3; 5.3.0 before 5.3.3; 5.4.0 before 5.4.2; 5.4.0 before 5.4.2; 5.5.0; 5.5.0 |
| CVE-2024-21683 | 8.8 | May 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server Affected: 5.4.0 before 5.4.21; 5.12.0 before 5.12.8; 5.15.2 before 5.16.0; 5.4.0 before 5.4.21; 5.12.0 before 5.12.8; 5.15.2 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: 4.14.0 before 4.20.10; 4.14.0 before 4.20.10; 4.21.0 before 4.22.4; 4.21.0 before 4.22.4 |
| CVE-2021-39115 | 7.2 | Sep 1 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run… Affected: 4.14.0 before 4.18.0; 4.14.0 before 4.18.0 |
| CVE-2022-26135 | 6.5 | Jun 30 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read… Affected: 4.14.0 before 4.20.10; 4.14.0 before 4.20.10; 4.21.0 before 4.22.4; 4.21.0 before 4.22.4 |
| CVE-2021-43959 | 5.7 | Jul 26 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a… Affected: 4.14.0 before 4.20.8; 4.14.0 before 4.20.8; 4.21.0 before 4.22.2; 4.21.0 before 4.22.2 |
| CVE-2021-43943 | 4.8 | Feb 24 | Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site… Affected: before 4.21.0; before 4.21.0 |
| CVE-2022-36800 | 4.3 | Aug 3 | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information… Affected: before 4.22.2; before 4.22.2 |
| CVE-2021-43948 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper… Affected: before 4.21.0; before 4.21.0 |
| CVE-2021-43950 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken… Affected: before 4.21.0; before 4.21.0 |
| CVE-2021-43951 | 4.3 | Jan 10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information… Affected: before 4.21.0; before 4.21.0 |
| CVE-2021-43949 | 4.3 | Jan 10 | Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control… Affected: before 4.21.0; before 4.21.0 |
Showing 17