Atlassian : Security Vulnerabilities CVSS score between 4 and 4.99
The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access internal network resources via a Server-Side Request Forgery. This can be exploited by a remote, unauthenticated attacker with Super Admin privileges by sending a specially crafted HTTP request.
| Max Base Score | 4.9 |
| Published | 2022-10-14 |
| Updated | 2022-10-17 |
| EPSS | 0.13% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.
| Max Base Score | 4.3 |
| Published | 2022-08-03 |
| Updated | 2022-08-09 |
| EPSS | 0.08% |
The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain information about installation directories via information disclosure vulnerability.
| Max Base Score | 4.3 |
| Published | 2022-03-16 |
| Updated | 2022-03-22 |
| EPSS | 0.08% |
The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.
| Max Base Score | 4.3 |
| Published | 2022-03-14 |
| Updated | 2022-03-18 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint. The affected versions are before version 8.13.16, and from version 8.14.0 before 8.20.5.
| Max Base Score | 4.3 |
| Published | 2022-02-15 |
| Updated | 2022-04-25 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint. The affected versions are before version 8.21.0.
| Max Base Score | 4.3 |
| Published | 2022-02-15 |
| Updated | 2022-06-03 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0.
| Max Base Score | 4.3 |
| Published | 2022-01-10 |
| Updated | 2022-03-04 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0.
| Max Base Score | 4.3 |
| Published | 2022-02-15 |
| Updated | 2022-07-12 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0.
| Max Base Score | 4.3 |
| Published | 2022-01-10 |
| Updated | 2022-03-04 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the "Move objects" feature. The affected versions are before version 4.21.0.
| Max Base Score | 4.3 |
| Published | 2022-02-15 |
| Updated | 2022-07-12 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint. The affected versions are before version 8.20.3.
| Max Base Score | 4.8 |
| Published | 2022-02-28 |
| Updated | 2022-03-08 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0.
| Max Base Score | 4.8 |
| Published | 2022-02-24 |
| Updated | 2022-03-07 |
| EPSS | 0.05% |
Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization vulnerability in the /secure/admin/ConfigureBatching!default.jspa endpoint. The affected versions are before version 8.20.7.
| Max Base Score | 4.3 |
| Published | 2021-11-01 |
| Updated | 2022-11-16 |
| EPSS | 0.08% |
The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are able to trick a user into retrying a request to bypass CSRF protection and replay a crafted request.
| Max Base Score | 4.3 |
| Published | 2021-09-14 |
| Updated | 2022-02-24 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an Information Disclosure vulnerability in the /rest/api/latest/projectvalidate/key endpoint. The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.
| Max Base Score | 4.3 |
| Published | 2021-09-08 |
| Updated | 2022-03-30 |
| EPSS | 0.08% |
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.
| Max Base Score | 4.8 |
| Published | 2021-08-30 |
| Updated | 2021-09-02 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
| Max Base Score | 4.9 |
| Published | 2021-08-25 |
| Updated | 2022-03-30 |
| EPSS | 0.07% |
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https.
| Max Base Score | 4.3 |
| Published | 2021-04-15 |
| Updated | 2022-03-30 |
| EPSS | 0.07% |
The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an information disclosure vulnerability in the error message when presented with an invalid filename.
| Max Base Score | 4.3 |
| Published | 2021-04-15 |
| Updated | 2022-03-30 |
| EPSS | 0.08% |
The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability.
| Max Base Score | 4.3 |
| Published | 2021-04-01 |
| Updated | 2022-07-27 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.
| Max Base Score | 4.8 |
| Published | 2021-02-15 |
| Updated | 2022-03-30 |
| EPSS | 0.07% |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an Insecure Direct Object References (IDOR) vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.2.
| Max Base Score | 4.3 |
| Published | 2021-02-02 |
| Updated | 2022-03-30 |
| EPSS | 0.08% |
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1.
| Max Base Score | 4.3 |
| Published | 2021-02-15 |
| Updated | 2022-03-25 |
| EPSS | 0.08% |
Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the file upload request feature of code reviews. The affected versions are before version 4.7.4, and from version 4.8.0 before 4.8.5.
| Max Base Score | 4.3 |
| Published | 2020-12-21 |
| Updated | 2020-12-22 |
| EPSS | 0.11% |
Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters.
| Max Base Score | 4.3 |
| Published | 2021-05-07 |
| Updated | 2022-05-13 |
| EPSS | 0.05% |