JI
DevOps
Jira
On CISA KEVExploited in the wild
195
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 144Low 3
Watch
Add Jira to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-11583 | 6.5 | Jun 26 | The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering… Affected: before 8.1.0 |
| CVE-2017-18101 | 6.5 | Apr 10 | Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version… Affected: before 7.6.5 |
| CVE-2017-18033 | 6.5 | Jan 18 | The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various… Affected: before 7.6.1 |
| CVE-2022-36801 | 6.1 | Aug 10 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS)… Affected: before 8.20.8 |
| CVE-2021-43942 | 6.1 | Jan 4 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability… Affected: 8.14.0 before 8.20.3 |
| CVE-2021-41304 | 6.1 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability… Affected: 8.14.0 before 8.20.2 |
| CVE-2021-39111 | 6.1 | Aug 30 | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to… Affected: before 8.5.18 |
| CVE-2021-26080 | 6.1 | Jun 7 | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote… Affected: before 8.5.14; 8.6.0 before 8.13.6; 8.14.0 before 8.16.1 |
| CVE-2021-26079 | 6.1 | Jun 7 | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0… Affected: before 8.5.15 |
| CVE-2021-26078 | 6.1 | Jun 7 | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version… Affected: before 8.5.14 |
| CVE-2020-36288 | 6.1 | Apr 15 | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |
| CVE-2020-36236 | 6.1 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: 8.6.0 before 8.13.3; 8.14.0 before 8.15.0 |
| CVE-2019-20901 | 6.1 | Jul 13 | The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may… Affected: 8.6.0 |
| CVE-2020-4022 | 6.1 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2020-14169 | 6.1 | Jul 1 | The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)… Affected: before 8.9.1 |
| CVE-2020-14164 | 6.1 | Jul 1 | The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting… Affected: before 8.8.2 |
| CVE-2019-14996 | 6.1 | Sep 11 | The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a… Affected: 7.12.0 before 7.13.7; 8.0.0 before 8.3.3 |
| CVE-2019-11589 | 6.1 | Aug 23 | The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to… Affected: 7.13.0 before 7.13.6; 8.0.0 before 8.2.3; 8.3.0 before 8.3.2 |
| CVE-2019-11585 | 6.1 | Aug 23 | The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect… Affected: 8.0.0 before 8.2.3; 8.3.0 before 8.3.2 |
| CVE-2019-11584 | 6.1 | Aug 23 | The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in… Affected: before 8.3.2 |
| CVE-2019-3402 | 6.1 | May 22 | The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via… Affected: 8.0.0 before 8.1.1 |
| CVE-2019-3400 | 6.1 | May 3 | The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: before 7.13.2; 8.0.0 before 8.0.2 |
| CVE-2018-20824 | 6.1 | May 3 | The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the… Affected: before 7.13.1 |
| CVE-2018-13402 | 6.1 | Oct 23 | Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3,… Affected: 7.7.0 before 7.7.5; 7.8.0 before 7.8.5; 7.9.0 before 7.9.3; 7.10.0 before 7.10.3; 7.11.0 before 7.11.3; 7.12.0 before 7.12.3; +1 more |
| CVE-2018-13401 | 6.1 | Oct 23 | The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before… Affected: before 7.6.9 |
| CVE-2018-13395 | 6.1 | Aug 28 | Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version… Affected: before 7.6.8 |
| CVE-2018-5232 | 6.1 | Jul 18 | The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via… Affected: before 7.6.7 |
| CVE-2018-13387 | 6.1 | Jul 16 | The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version… Affected: before 7.6.7 |
| CVE-2018-5230 | 6.1 | May 14 | The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version… Affected: before 7.6.6 |
| CVE-2017-18100 | 6.1 | Apr 10 | The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in… Affected: before 7.8.1 |
| CVE-2017-18098 | 6.1 | Apr 6 | The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability… Affected: before 7.6.1 |
| CVE-2017-18039 | 6.1 | Feb 2 | The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site… Affected: 6.2.1 before 7.4.4 |
| CVE-2017-16863 | 6.1 | Jan 18 | The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through… Affected: before 7.5.3 |
| CVE-2017-16864 | 6.1 | Jan 12 | The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in… Affected: before 7.4.2 |
| CVE-2017-14594 | 6.1 | Jan 12 | The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or… Affected: before 7.2.12 |
| CVE-2016-6285 | 6.1 | Jan 31 | Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or… Affected: through 7.2.1 |
| CVE-2020-14168 | 5.9 | Jul 1 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to… Affected: before 7.13.14 |
| CVE-2017-18104 | 5.9 | Jul 24 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept… Affected: before 7.6.7 |
| CVE-2021-39116 | 5.5 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF… Affected: before 8.13.14; 8.14.0 before 8.19.0 |
| CVE-2021-26083 | 5.4 | Jul 20 | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote… Affected: before 8.5.14 |
| CVE-2021-26082 | 5.4 | Jul 20 | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers… Affected: before 8.5.14 |
| CVE-2020-14184 | 5.4 | Oct 12 | Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export… Affected: 8.6.0 before 8.12.3; 8.13.0 |
| CVE-2020-14173 | 5.4 | Jul 3 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: 8.6.0 before 8.6.2; 8.7.0 before 8.7.1 |
| CVE-2020-4024 | 5.4 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20414 | 5.4 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue… Affected: before 7.13.9 |
| CVE-2020-4021 | 5.4 | Jun 1 | Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: 8.0.0 before 8.5.5; 8.6.0 before 8.8.1 |
| CVE-2012-1500 | 5.4 | Feb 13 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code Affected: 4.4.3 |
| CVE-2019-8444 | 5.4 | Aug 23 | The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: 7.7 before 7.13.6; 8.0.0 before 8.3.2 |
| CVE-2018-20827 | 5.4 | Aug 9 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the… Affected: 7.0.0 before 7.13.1 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 7.13.3; 8.0.0 before 8.1.0 |