JI
DevOps
Jira
On CISA KEVExploited in the wild
195
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 144Low 3
Watch
Add Jira to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-20232 | 5.4 | Feb 13 | The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a… Affected: before 7.6.11; next of 7.7.0 before unspecified; before 7.13.1 |
| CVE-2018-13403 | 5.4 | Feb 13 | The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1… Affected: before 7.6.10; 7.7.0 before unspecified; before 7.12.4; 7.13.0 before unspecified; before 7.13.1 |
| CVE-2017-18102 | 5.4 | Apr 17 | The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting… Affected: 7.5.0 before 7.6.8; 7.7.0 before 7.7.1; 8.0.0 before 8.0.22 |
| CVE-2017-18097 | 5.4 | Apr 6 | The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject… Affected: before 7.6.1 |
| CVE-2021-39127 | 5.3 | Oct 21 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability (BAC)… Affected: before 8.5.10 |
| CVE-2021-39125 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration vulnerability in the password… Affected: before 8.5.10 |
| CVE-2021-39118 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration vulnerability in the… Affected: before 8.19.0 |
| CVE-2019-20101 | 5.3 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability in the… Affected: before 8.13.3; 8 |
| CVE-2021-39122 | 5.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability in the… Affected: before 8.5.13 |
| CVE-2021-39119 | 5.3 | Sep 1 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their Jira account is… Affected: before 8.19.0 |
| CVE-2021-26081 | 5.3 | Jul 20 | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to… Affected: 8.6.0 before 8.13.6; 8.14.0 before 8.16.1 |
| CVE-2020-36289 | 5.3 | May 12 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the… Affected: before 8.5.13 |
| CVE-2020-36287 | 5.3 | Apr 9 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version… Affected: 8.14.0 before 8.15.1 |
| CVE-2020-36286 | 5.3 | Apr 1 | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2020-36238 | 5.3 | Apr 1 | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2021-26069 | 5.3 | Mar 22 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information… Affected: 8.6.0 before 8.13.3; 8.14.0 before 8.15.0 |
| CVE-2020-29453 | 5.3 | Feb 22 | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before 8.15.0 allowed… Affected: 8.5.10 before 8.5.11; 8.6.0 before 8.13.3; 8.14.0 before 8.15.0 |
| CVE-2020-36237 | 5.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the… Affected: before 8.15.0 |
| CVE-2020-36235 | 5.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure… Affected: 8.14.0 before 8.14.1 |
| CVE-2020-14185 | 5.3 | Oct 15 | Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the ActionsAndOperations resource Affected: 8.0.0 before 8.5.9; 8.6.0 before 8.12.2 |
| CVE-2020-14179 | 5.3 | Sep 21 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure… Affected: before 8.5.8; 8.6.0 before 8.11.1 |
| CVE-2020-14181 | 5.3 | Sep 17 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa… Affected: before 7.13.6 |
| CVE-2019-20899 | 5.3 | Jul 13 | The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the… Affected: 8.5.5 before 8.6.1; 8.6.2 before 8.7.0 |
| CVE-2020-14165 | 5.3 | Jul 1 | The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars… Affected: before 8.9.0 |
| CVE-2019-20408 | 5.3 | Jul 1 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side… Affected: before 8.7.0 |
| CVE-2019-20412 | 5.3 | Jun 29 | The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information via an Improper… Affected: 8.0.0 before 8.4.2 |
| CVE-2020-4028 | 5.3 | Jun 23 | Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed… Affected: before 8.9.1 |
| CVE-2019-20403 | 5.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure… Affected: after 7.13.0 before 8.5.5 |
| CVE-2019-8449 | 5.3 | Sep 11 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability Affected: before 8.4.0 |
| CVE-2019-14995 | 5.3 | Sep 11 | The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is… Affected: 7.6.0 before 8.4.0 |
| CVE-2019-8446 | 5.3 | Aug 23 | The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check Affected: 7.6 before 8.3.2 |
| CVE-2019-8445 | 5.3 | Aug 23 | Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing… Affected: 7.13.0 before 7.13.7; 8.0.0 before 8.3.2 |
| CVE-2019-8448 | 5.3 | Aug 13 | The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attackers to enumerate usernames via an information disclosure… Affected: 7.11.0 before 7.13.4; 8.0.0 before 8.2.2 |
| CVE-2019-3403 | 5.3 | May 22 | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote… Affected: before 7.13.3 |
| CVE-2019-3401 | 5.3 | May 22 | The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect… Affected: 8.0.0 before 8.1.1 |
| CVE-2018-13391 | 5.3 | Aug 28 | The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0… Affected: before 7.6.8 |
| CVE-2017-16865 | 5.3 | Jan 17 | The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) Affected: before 7.6.1 |
| CVE-2019-20402 | 4.9 | Feb 6 | Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their… Affected: before 8.6.0 |
| CVE-2021-43945 | 4.8 | Feb 28 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored… Affected: before 8.20.3 |
| CVE-2021-39117 | 4.8 | Aug 30 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site… Affected: before 8.18.0 |
| CVE-2021-39112 | 4.8 | Aug 25 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project… Affected: before 8.5.15 |
| CVE-2020-36234 | 4.8 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the… Affected: 8.6.0 before 8.13.3; 8.14.0 before 8.15.0 |
| CVE-2019-20900 | 4.8 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add… Affected: 8.2.1 before 8.7.0 |
| CVE-2020-4025 | 4.8 | Jul 1 | The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0… Affected: 8.6.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20416 | 4.8 | Jun 30 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the… Affected: before 8.3.0 |
| CVE-2019-8450 | 4.8 | Sep 11 | Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom… Affected: 7.13.0 before 7.13.6; 8.0.0 before 8.4.0 |
| CVE-2016-4318 | 4.8 | Apr 10 | Atlassian JIRA Server before 7.1.9 has XSS in project/ViewDefaultProjectRoleActors.jspa via a role name Affected: through 7.1.8 |
| CVE-2019-20100 | 4.7 | Feb 12 | The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF) Affected: 8.5.5 before 8.6.2 |
| CVE-2018-13400 | 4.7 | Oct 23 | Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0… Affected: before 7.6.9 |
| CVE-2019-15002 | 4.3 | Feb 11 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0 Affected: before 8.1.0 |