JS
Product
Jira Software Data Center
On CISA KEVExploited in the wild
40
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 9Medium 29Low 0
Watch
Add Jira Software Data Center to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-41308 | 6.5 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings via a Broken Access… Affected: before 8.6.0; 8.14.0 before 8.20.1 |
| CVE-2019-20897 | 6.5 | Jul 13 | The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file Affected: before 8.5.4 |
| CVE-2019-20418 | 6.5 | Jul 3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability… Affected: before 8.8.0 |
| CVE-2019-20410 | 6.5 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in the comment… Affected: before 7.6.17 |
| CVE-2021-41310 | 6.1 | Nov 1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability… Affected: before 8.5.19; 8.6.0 before 8.13.11; 8.14.0 before 8.19.1 |
| CVE-2020-36236 | 6.1 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: before 8.5.11; 8.14.0 before 8.15.0 |
| CVE-2020-4022 | 6.1 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: before 8.5.5 |
| CVE-2020-14169 | 6.1 | Jul 1 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)… Affected: before 8.9.1 |
| CVE-2020-14164 | 6.1 | Jul 1 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting… Affected: before 8.8.2 |
| CVE-2020-14168 | 5.9 | Jul 1 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to… Affected: before 7.13.14 |
| CVE-2020-14173 | 5.4 | Jul 3 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: before 8.5.4 |
| CVE-2020-4024 | 5.4 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: before 8.5.5 |
| CVE-2019-20414 | 5.4 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue… Affected: before 7.13.9 |
| CVE-2020-4021 | 5.4 | Jun 1 | Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: before 7.13.16 |
| CVE-2021-41309 | 5.3 | Dec 8 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira… Affected: before 8.19.1 |
| CVE-2021-39127 | 5.3 | Oct 21 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC)… Affected: before 8.5.10 |
| CVE-2020-36235 | 5.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure… Affected: before 8.13.2; 8.14.0 before 8.14.1 |
| CVE-2019-20899 | 5.3 | Jul 13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the… Affected: before 8.5.4 |
| CVE-2020-14165 | 5.3 | Jul 1 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars… Affected: before 8.9.0 |
| CVE-2019-20412 | 5.3 | Jun 29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper… Affected: before 7.13.9 |
| CVE-2020-4028 | 5.3 | Jun 23 | Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed… Affected: before 8.9.1 |
| CVE-2019-20402 | 4.9 | Feb 6 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their… Affected: before 8.6.0 |
| CVE-2020-4025 | 4.8 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0… Affected: before 8.5.5 |
| CVE-2019-20416 | 4.8 | Jun 30 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the… Affected: before 8.3.0 |
| CVE-2020-36231 | 4.3 | Feb 2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object… Affected: before 8.5.10 |
| CVE-2020-14174 | 4.3 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability… Affected: before 7.13.16 |
| CVE-2020-4029 | 4.3 | Jul 1 | The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows… Affected: before 8.5.5 |
| CVE-2019-20415 | 4.3 | Jun 30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability Affected: before 7.13.3 |
| CVE-2019-20106 | 4.3 | Feb 6 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make… Affected: before 7.13.12 |
Showing 29