JI
DevOps
Jira
On CISA KEVExploited in the wild
198
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 28Medium 146Low 3
Watch
Add Jira to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-14594 | 6.1 | Jan 12 | The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or… Affected: prior 7.2.12; 7.3.0 before 7.6.1 |
| CVE-2017-16864 | 6.1 | Jan 12 | The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in… Affected: prior to 7.4.2 |
| CVE-2016-6285 | 6.1 | Jan 31 | Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or… Affected: through 7.2.1 |
| CVE-2020-14168 | 5.9 | Jul 1 | The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to… Affected: 8.5.0 before 8.5.5; 8.8.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2017-18104 | 5.9 | Jul 24 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept… Affected: before 7.6.7; 7.7.0 before unspecified; before 7.11.0 |
| CVE-2021-39116 | 5.5 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the GIF… Affected: before 8.13.14; 8.14.0 before unspecified; before 8.19.0 |
| CVE-2021-26083 | 5.4 | Jul 20 | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote… Affected: before 8.5.14; 8.6.0 before unspecified; before 8.13.6; 8.14.0 before unspecified; before 8.16.1 |
| CVE-2021-26082 | 5.4 | Jul 20 | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers… Affected: before 8.5.14; 8.6.0 before unspecified; before 8.13.6; 8.14.0 before unspecified; before 8.17.0 |
| CVE-2020-14184 | 5.4 | Oct 12 | Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export… Affected: before 8.5.9; 8.6.0 before unspecified; before 8.12.3; 8.13.0 before unspecified; before 8.13.1 |
| CVE-2020-14173 | 5.4 | Jul 3 | The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: before 8.5.4; 8.6.0 before unspecified; before 8.6.2; 8.7.0 before unspecified; before 8.7.1 |
| CVE-2020-4024 | 5.4 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20414 | 5.4 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue… Affected: before 7.13.9; 8.0.0 before unspecified; before 8.4.2 |
| CVE-2020-4021 | 5.4 | Jun 1 | Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: 8.0.0 before 8.5.5; 8.6.0 before 8.8.1 |
| CVE-2012-1500 | 5.4 | Feb 13 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code Affected: 4.4.3 |
| CVE-2019-8444 | 5.4 | Aug 23 | The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross… Affected: before 7.13.6; 8.0.0 before unspecified; before 8.3.2 |
| CVE-2018-20827 | 5.4 | Aug 9 | The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the… Affected: before 7.13.1 |
| CVE-2018-20239 | 5.4 | Apr 30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4… Affected: before 7.13.3; 8.0.0 before 8.1.0 |
| CVE-2018-20232 | 5.4 | Feb 13 | The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a… Affected: before 7.6.11; next of 7.7.0 before unspecified; before 7.13.1 |
| CVE-2018-13403 | 5.4 | Feb 13 | The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1… Affected: before 7.6.10; 7.7.0 before unspecified; before 7.12.4; 7.13.0 before unspecified; before 7.13.1 |
| CVE-2017-18102 | 5.4 | Apr 17 | The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: 7.5.0 before 7.6.8; 7.7.0 before 7.7.1; 8.0.0 before 8.0.22 |
| CVE-2017-18097 | 5.4 | Apr 6 | The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject… Affected: before 7.6.1 |
| CVE-2021-41309 | 5.3 | Dec 8 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira… Affected: before 8.19.1 |
| CVE-2021-39127 | 5.3 | Oct 21 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC)… Affected: before 8.5.10; 8.6.0 before unspecified; before 8.13.1 |
| CVE-2021-39125 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password… Affected: before 8.5.10; 8.6.0 before unspecified; before 8.13.1 |
| CVE-2019-20101 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the… Affected: before 8.13.3; 8.14.0 before unspecified; before 8.14.1 |
| CVE-2021-39118 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the… Affected: before 8.19.0 |
| CVE-2021-39122 | 5.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the… Affected: before 8.5.13; 8.6.0 before unspecified; before 8.13.5; 8.14.0 before unspecified; before 8.15.1 |
| CVE-2021-39119 | 5.3 | Sep 1 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is… Affected: before 8.19.0 |
| CVE-2021-26081 | 5.3 | Jul 20 | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to… Affected: before 8.5.14; 8.6.0 before unspecified; before 8.13.6; 8.14.0 before unspecified; before 8.16.1 |
| CVE-2020-36289 | 5.3 | May 12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… Affected: before 8.5.13; 8.6.0 before unspecified; before 8.13.5; 8.14.0 before unspecified; before 8.15.1 |
| CVE-2020-36287 | 5.3 | Apr 9 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version… Affected: before 8.13.5; 8.14.0 before unspecified; before 8.15.1 |
| CVE-2020-36286 | 5.3 | Apr 1 | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: before 8.5.13; 8.6.0 before unspecified; before 8.13.5; 8.14.0 before unspecified; before 8.15.1 |
| CVE-2020-36238 | 5.3 | Apr 1 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: before 8.5.13; 8.6.0 before unspecified; before 8.13.5; 8.14.0 before unspecified; before 8.15.1 |
| CVE-2021-26069 | 5.3 | Mar 22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information… Affected: before 8.5.11; 8.6.0 before unspecified; before 8.13.3; 8.14.0 before unspecified; before 8.15.0 |
| CVE-2020-29453 | 5.3 | Feb 18 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed… Affected: before 8.5.11; 8.6.0 before unspecified; before 8.13.3; 8.14.0 before unspecified; before 8.15.0 |
| CVE-2020-36237 | 5.3 | Feb 14 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the… Affected: before 8.15.0 |
| CVE-2020-36235 | 5.3 | Feb 14 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure… Affected: before 8.13.2; 8.14.0 before unspecified; before 8.14.1 |
| CVE-2020-14185 | 5.3 | Oct 15 | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource Affected: before 7.13.18; 8.0.0 before unspecified; 8.6.0 before unspecified; before 8.12.2 |
| CVE-2020-14179 | 5.3 | Sep 21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure… Affected: before 8.5.8; 8.6.0 before unspecified; before 8.11.1 |
| CVE-2020-14181 | 5.3 | Sep 17 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa… Affected: before 7.13.6; 8.0.0 before unspecified; before 8.5.7; 8.6.0 before unspecified; before 8.12.0 |
| CVE-2019-20899 | 5.3 | Jul 13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the… Affected: before 8.5.4; 8.6.0 before unspecified; before 8.6.1 |
| CVE-2020-14165 | 5.3 | Jul 1 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars… Affected: before 8.9.0 |
| CVE-2019-20408 | 5.3 | Jul 1 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side… Affected: before 8.7.0 |
| CVE-2019-20412 | 5.3 | Jun 29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper… Affected: before 7.13.9; 8.0.0 before unspecified; before 8.4.2 |
| CVE-2020-4028 | 5.3 | Jun 23 | Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed… Affected: before 8.9.1 |
| CVE-2019-20403 | 5.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure… Affected: before 8.6.0 |
| CVE-2019-8449 | 5.3 | Sep 11 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability Affected: before 8.4.0 |
| CVE-2019-14995 | 5.3 | Sep 11 | The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is… Affected: before 8.4.0 |
| CVE-2019-8446 | 5.3 | Aug 23 | The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check Affected: before 8.3.2 |
| CVE-2019-8445 | 5.3 | Aug 23 | Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing… Affected: before 7.13.7; 8.0.0 before unspecified; before 8.3.2 |