JI
DevOps
Jira
On CISA KEVExploited in the wild
195
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 27Medium 144Low 3
Watch
Add Jira to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-22157 | 8.8 | May 20 | This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0,… Affected: 9.12.0 before 9.12.20; 10.3.0 before 10.3.5; 10.4.0 before 10.5.1 |
| CVE-2024-21683 | 8.8 | May 21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server Affected: 9.4.0 before 9.4.21; 9.12.0 before 9.12.8 |
| CVE-2022-26137 | 8.8 | Jul 20 | A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests… Affected: 8.13.0 before 8.13.22; 8.14.0 before 8.20.10; 8.21.0 before 8.22.4 |
| CVE-2017-18113 | 8.8 | Aug 2 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their… Affected: before 8.18.1 |
| CVE-2016-4319 | 8.8 | Apr 10 | Atlassian JIRA Server before 7.1.9 has CSRF in auditing/settings Affected: through 7.1.8 |
| CVE-2019-8443 | 8.1 | May 22 | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have… Affected: before 7.13.4 |
| CVE-2019-20419 | 7.8 | Jul 3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat Affected: before 8.5.5; 8.6.0 before 8.7.2 |
| CVE-2019-20400 | 7.8 | Feb 6 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject… Affected: 8.3.2 before 8.5.2; 8.5.3 before 8.6.0 |
| CVE-2021-41312 | 7.5 | Nov 3 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and disable Issue… Affected: before 8.19.1 |
| CVE-2021-41307 | 7.5 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct… Affected: before 8.13.12 |
| CVE-2021-41306 | 7.5 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References… Affected: before 8.13.12 |
| CVE-2021-41305 | 7.5 | Oct 26 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object… Affected: before 8.13.12 |
| CVE-2021-39123 | 7.5 | Sep 14 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of Service (DoS)… Affected: before 8.16.0 |
| CVE-2021-39113 | 7.5 | Aug 30 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access… Affected: before 8.13.9 |
| CVE-2020-14178 | 7.5 | Sep 1 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the /browse.PROJECTKEY… Affected: before 7.13.7 |
| CVE-2019-20898 | 7.5 | Jul 13 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen Affected: before 8.8.0 |
| CVE-2020-14167 | 7.5 | Jul 1 | The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows… Affected: 8.5.0 before 8.5.5; 8.8.0 before 8.8.2; 8.9.0 before 8.9.1 |
| CVE-2019-20413 | 7.5 | Jun 29 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability on the… Affected: 8.0.0 before 8.4.2 |
| CVE-2019-8442 | 7.5 | May 22 | The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote… Affected: before 7.13.4 |
| CVE-2019-3399 | 7.5 | Apr 30 | The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects… Affected: 8.0.0 before 8.0.2 |
| CVE-2018-5231 | 7.5 | May 16 | The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0… Affected: before 7.6.6 |
| CVE-2022-36799 | 7.2 | Aug 1 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented Affected: before 8.13.19; 8.14.0 before unspecified; before 8.20.7; 8.21.0 before unspecified; before 8.22.1 |
| CVE-2021-43944 | 7.2 | Mar 8 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented Affected: before 8.13.15; 8.14.0 before 8.20.3 |
| CVE-2021-43947 | 7.2 | Jan 6 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code Execution (RCE)… Affected: before 8.13.15 |
| CVE-2021-39128 | 7.2 | Sep 16 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java… Affected: before 8.13.12; 8.14.0 before 8.19.1 |
| CVE-2021-26070 | 7.2 | Mar 22 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication… Affected: 8.14.0 before 8.14.1 |
| CVE-2019-15001 | 7.2 | Sep 19 | The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before… Affected: 7.0.10 before 7.6.16; 7.7.0 before 7.13.8; 8.0.0 before 8.1.3; 8.2.0 before 8.2.5; 8.3.0 before 8.3.4; 8.4.0 |
Showing 27