JI
DevOps
Jira
On CISA KEVExploited in the wild
195
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 144Low 3
Watch
Add Jira to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43953 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site… Affected: before 8.13.16; 8.14.0 before 8.20.5 |
| CVE-2021-43952 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery… Affected: before 8.13.18; 8.20.0 before 8.20.6 |
| CVE-2021-41313 | 4.3 | Nov 1 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization… Affected: before 8.20.7 |
| CVE-2021-39124 | 4.3 | Sep 14 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user… Affected: before 8.16.0 |
| CVE-2021-39121 | 4.3 | Sep 8 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure… Affected: before 8.5.18 |
| CVE-2021-26075 | 4.3 | Apr 15 | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before… Affected: 8.6.0 before 8.13.4; 8.14.0 before 8.15.1 |
| CVE-2020-29451 | 4.3 | Feb 15 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects… Affected: 8.6.0 before 8.13.3; 8.14.0 before 8.14.1 |
| CVE-2020-36231 | 4.3 | Feb 2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object… Affected: 8.6.0 before 8.13.2; 8.13.3 |
| CVE-2020-14183 | 4.3 | Oct 6 | Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an… Affected: before 7.13.18; before 7.13.18; 8.0.0 before 8.5.9; 8.0.0 before 8.5.9; 8.6.0 before 8.12.1; 8.6.0 before 8.12.1 |
| CVE-2020-14174 | 4.3 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability… Affected: 8.0.0 before 8.5.7; 8.6.0 before 8.9.2; 8.10.0 |
| CVE-2020-4029 | 4.3 | Jul 1 | The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows… Affected: 8.6.0 before 8.7.2; 8.8.0 before 8.8.1 |
| CVE-2019-20415 | 4.3 | Jun 30 | Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery (CSRF) vulnerability Affected: before 7.13.3 |
| CVE-2019-20411 | 4.3 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF) vulnerability Affected: 8.0.0 before 8.4.2 |
| CVE-2019-20407 | 4.3 | Mar 17 | The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information… Affected: 8.4.1 before 8.5.3; 8.5.4 before 8.6.1; 8.6.2 before 8.7.0 |
| CVE-2019-20099 | 4.3 | Feb 12 | The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF) Affected: 7.6.15 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-20098 | 4.3 | Feb 12 | The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF) Affected: 7.6.15 before 8.5.4; 8.5.5 before 8.6.2 |
| CVE-2019-20405 | 4.3 | Feb 6 | The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request… Affected: 7.13.0 before 8.6.0 |
| CVE-2019-20404 | 4.3 | Feb 6 | The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper… Affected: 8.2.4 before 8.6.0; 8.6.1 before 8.7.0 |
| CVE-2019-20106 | 4.3 | Feb 6 | Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make… Affected: 8.0.0 before 8.5.4; 8.6.0 |
| CVE-2019-15013 | 4.3 | Dec 18 | The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows… Affected: 8.0.0 before 8.4.3; 8.5.0 before 8.5.2 |
| CVE-2019-15005 | 4.3 | Nov 8 | The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate periodic log scans and send the results to a user-specified… Affected: before 8.3.2 |
| CVE-2019-14997 | 4.3 | Sep 11 | The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an information expose… Affected: 7.13.0 before 8.4.0 |
| CVE-2019-8447 | 4.3 | Aug 23 | The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability Affected: 7.13.0 before 8.3.2 |
| CVE-2019-11588 | 4.3 | Aug 23 | The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows… Affected: 8.0.0 before 8.2.3; 8.3.0 before 8.3.2 |
| CVE-2019-11586 | 4.3 | Aug 23 | The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to… Affected: 8.0.0 before 8.2.3; 8.3.0 before 8.3.2 |
| CVE-2018-20826 | 4.3 | Aug 9 | The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check Affected: before 7.12.3 |
| CVE-2017-16862 | 4.3 | Jan 12 | The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist setting via a Cross-site request forgery… Affected: before 7.6.2 |
| CVE-2018-13404 | 4.1 | Feb 13 | The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version… Affected: before 7.6.10; 7.7.0 before unspecified; before 7.7.5; 7.8.0 before unspecified; before 7.8.5; 7.9.0 before unspecified; +9 more |
| CVE-2021-26076 | 3.7 | Apr 15 | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version… Affected: before 8.5.12 |
| CVE-2021-26071 | 3.5 | Apr 1 | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1… Affected: 8.6.0 before 8.13.5; 8.14.0 before 8.15.1 |
| CVE-2015-8481 | 3.1 | Jan 8 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with… Affected: 7.0.3 |
| CVE-2014-2314 | – | Mar 9 | Directory traversal vulnerability in the Issue Collector plugin in Atlassian JIRA before 6.0.4 allows remote attackers to create arbitrary files via unspecified vectors Affected: through 6.0.3; 6.0; 6.0.1; 6.0.2 |
| CVE-2014-2313 | – | Mar 9 | Directory traversal vulnerability in the Importers plugin in Atlassian JIRA before 6.0.5 allows remote attackers to create arbitrary files via unspecified vectors Affected: through 6.0.4; 6.0; 6.0.1; 6.0.2; 6.0.3 |
| CVE-2013-5319 | – | Aug 20 | Cross-site scripting (XSS) vulnerability in secure/admin/user/views/deleteuserconfirm.jsp in the Admin Panel in Atlassian JIRA before 6.0.5 allows remote attackers to inject… Affected: through 6.0.4; 6.0; 6.0.1; 6.0.2; 6.0.3 |
| CVE-2012-2928 | – | May 22 | The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows… Affected: through 5.0.0 |
| CVE-2010-1165 | – | Apr 20 | Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing),… Affected: 3.12; 3.12.1; 3.12.2; 3.12.3; 3.13; 3.13.1; +8 more |
| CVE-2010-1164 | – | Apr 20 | Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2)… Affected: 3.12; 3.12.1; 3.12.2; 3.12.3; 3.13; 3.13.1; +8 more |
| CVE-2008-6832 | – | Jun 8 | Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown… Affected: 3.13 |
| CVE-2008-6831 | – | Jun 8 | Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname… Affected: 3.13 |
| CVE-2008-6531 | – | Mar 26 | The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a crafted URL that is dynamically… Affected: before 3.13.2 |
| CVE-2007-6619 | – | Jan 3 | The Setup Wizard in Atlassian JIRA Enterprise Edition before 3.12.1 does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the… Affected: through 3.12 |
| CVE-2007-6618 | – | Jan 3 | JIRA Enterprise Edition before 3.12.1 allows remote attackers to delete another user's shared filter via a modified filter ID Affected: through 3.12 |
| CVE-2007-6617 | – | Jan 3 | Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not… Affected: through 3.12 |
| CVE-2006-3339 | – | Jul 3 | secure/ConfigureReleaseNote.jspa in Atlassian JIRA 3.6.2-#156 allows remote attackers to obtain sensitive information via unspecified manipulations of the projectId parameter,… Affected: 3.6.2_156 |
| CVE-2006-3338 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in Atlassian JIRA 3.6.2-#156 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a direct request to… Affected: 3.6.2_156 |