Atlassian Jira vulnerabilities

CVEs per yearBy the year they were published

1. 201819
2. 201933

Newest CVEs

• CVE-2019-15013

  The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version…

  Atlassian · Jira

  Medium4.3
• CVE-2019-8451

  The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via…

  Atlassian · Jira

  Medium6.5
• CVE-2019-8450

  Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have…

  Atlassian · Jira

  Medium4.8
• CVE-2019-8449

  The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure…

  Atlassian · Jira

  Medium5.3
• CVE-2019-14998

  The Webwork action Cross-Site Request Forgery (CSRF) protection implementation in Jira before version 8.4.0 allows remote attackers to bypass its protection…

  Atlassian · Jira

  Medium6.5
• CVE-2019-14997

  The AccessLogFilter class in Jira before version 8.4.0 allows remote anonymous attackers to learn details about other users, including their username, via an…

  Atlassian · Jira

  Medium4.3
• CVE-2019-14996

  The FilterPickerPopup.jspa resource in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML…

  Atlassian · Jira

  Medium6.1
• CVE-2019-14995

  The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and…

  Atlassian · Jira

  Medium5.3
• CVE-2019-8447

  The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery…

  Atlassian · Jira

  Medium4.3
• CVE-2019-8446

  The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

  Atlassian · Jira

  Medium5.3