# cve.now: Atlassian

The newest entries naming Atlassian as an affected vendor (up to 200), of 409 in all, 14 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-21589](https://cve.now/CVE-2026-21589.md): This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba (CVSS 9.3, KEV)
- [CVE-2026-21588](https://cve.now/CVE-2026-21588.md): This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, (CVSS 7.1)
- [CVE-2026-21587](https://cve.now/CVE-2026-21587.md): This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. (CVSS 7.1)
- [CVE-2026-21586](https://cve.now/CVE-2026-21586.md): This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, (CVSS 7.1)
- [CVE-2026-21584](https://cve.now/CVE-2026-21584.md): This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bam (CVSS 7.6)
- [CVE-2026-21582](https://cve.now/CVE-2026-21582.md): This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 o (CVSS 8.8)
- [CVE-2026-21580](https://cve.now/CVE-2026-21580.md): This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7. (CVSS 8.6)
- [CVE-2026-21575](https://cve.now/CVE-2026-21575.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windo (CVSS 7.1)
- [CVE-2026-21577](https://cve.now/CVE-2026-21577.md): This High severity DoS (Denial of Service) vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 (CVSS 7.1)
- [CVE-2026-21579](https://cve.now/CVE-2026-21579.md): This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2 (CVSS 8.2)
- [CVE-2026-21571](https://cve.now/CVE-2026-21571.md): This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, (CVSS 9.4)
- [CVE-2026-21570](https://cve.now/CVE-2026-21570.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0 (CVSS 8.6)
- [CVE-2026-21569](https://cve.now/CVE-2026-21569.md): This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. (CVSS 7.9)
- [CVE-2025-22178](https://cve.now/CVE-2025-22178.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22169](https://cve.now/CVE-2025-22169.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22173](https://cve.now/CVE-2025-22173.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22170](https://cve.now/CVE-2025-22170.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22174](https://cve.now/CVE-2025-22174.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22172](https://cve.now/CVE-2025-22172.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22176](https://cve.now/CVE-2025-22176.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22171](https://cve.now/CVE-2025-22171.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22168](https://cve.now/CVE-2025-22168.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22177](https://cve.now/CVE-2025-22177.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22175](https://cve.now/CVE-2025-22175.md): Jira Align is vulnerable to an authorization issue. (CVSS 5.3)
- [CVE-2025-22167](https://cve.now/CVE-2025-22167.md): This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of (CVSS 8.7)
- [CVE-2025-22166](https://cve.now/CVE-2025-22166.md): This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. (CVSS 8.3)
- [CVE-2025-22165](https://cve.now/CVE-2025-22165.md): This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. (CVSS 5.9)
- [CVE-2025-22157](https://cve.now/CVE-2025-22157.md): This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core (CVSS 7.2)
- [CVE-2023-22514](https://cve.now/CVE-2023-22514.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windo (CVSS 7.8)
- [CVE-2023-22512](https://cve.now/CVE-2023-22512.md): This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. (CVSS 7.5)
- [CVE-2019-15002](https://cve.now/CVE-2019-15002.md): An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. (CVSS 4.3)
- [CVE-2024-21703](https://cve.now/CVE-2024-21703.md): This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Window (CVSS 6.4)
- [CVE-2024-21697](https://cve.now/CVE-2024-21697.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetre (CVSS 8.8)
- [CVE-2024-21690](https://cve.now/CVE-2024-21690.md): This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0 (CVSS 7.1)
- [CVE-2024-21689](https://cve.now/CVE-2024-21689.md): This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, a (CVSS 7.6)
- [CVE-2024-21684](https://cve.now/CVE-2024-21684.md): There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. (CVSS 3.1)
- [CVE-2024-21687](https://cve.now/CVE-2024-21687.md): This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data (CVSS 8.1)
- [CVE-2024-21686](https://cve.now/CVE-2024-21686.md): This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. (CVSS 7.3)
- [CVE-2024-21685](https://cve.now/CVE-2024-21685.md): This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. (CVSS 7.4)
- [CVE-2024-21683](https://cve.now/CVE-2024-21683.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. (CVSS 7.2)
- [CVE-2024-21677](https://cve.now/CVE-2024-21677.md): This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. (CVSS 8.3)
- [CVE-2024-21678](https://cve.now/CVE-2024-21678.md): This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center. (CVSS 8.5)
- [CVE-2024-21682](https://cve.now/CVE-2024-21682.md): This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). (CVSS 7.2)
- [CVE-2024-21673](https://cve.now/CVE-2024-21673.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. (CVSS 8.0)
- [CVE-2024-21672](https://cve.now/CVE-2024-21672.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. (CVSS 8.3)
- [CVE-2023-22527](https://cve.now/CVE-2023-22527.md): A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE (CVSS 10.0, KEV)
- [CVE-2024-21674](https://cve.now/CVE-2024-21674.md): This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. (CVSS 8.6)
- [CVE-2023-22526](https://cve.now/CVE-2023-22526.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. (CVSS 7.2)
- [CVE-2023-22522](https://cve.now/CVE-2023-22522.md): This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input int (CVSS 9.0)
- [CVE-2023-22523](https://cve.now/CVE-2023-22523.md): This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery (CVSS 9.8)
- [CVE-2023-22524](https://cve.now/CVE-2023-22524.md): Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. (CVSS 9.6)
- [CVE-2023-22516](https://cve.now/CVE-2023-22516.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of Bamb (CVSS 8.5)
- [CVE-2023-22521](https://cve.now/CVE-2023-22521.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server. (CVSS 8.0)
- [CVE-2023-22518](https://cve.now/CVE-2023-22518.md): All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. (CVSS 10.0, KEV)
- [CVE-2023-22515](https://cve.now/CVE-2023-22515.md): Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow (CVSS 10.0, KEV)
- [CVE-2023-22513](https://cve.now/CVE-2023-22513.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. (CVSS 8.5)
- [CVE-2023-22506](https://cve.now/CVE-2023-22506.md): This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo (CVSS 7.5)
- [CVE-2023-22508](https://cve.now/CVE-2023-22508.md): This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent (CVSS 8.5)
- [CVE-2023-22505](https://cve.now/CVE-2023-22505.md): This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Cent (CVSS 8.0)
- [CVE-2023-22504](https://cve.now/CVE-2023-22504.md): Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to u (CVSS 4.3)
- [CVE-2023-22503](https://cve.now/CVE-2023-22503.md): Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and label (CVSS 5.3)
- [CVE-2023-22501](https://cve.now/CVE-2023-22501.md): An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate ano (CVSS 9.4)
- [CVE-2022-43782](https://cve.now/CVE-2022-43782.md): Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent (CVSS 9.8)
- [CVE-2022-43781](https://cve.now/CVE-2022-43781.md): There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. (CVSS 9.8)
- [CVE-2022-36803](https://cve.now/CVE-2022-36803.md): The MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissi (CVSS 8.8)
- [CVE-2022-36802](https://cve.now/CVE-2022-36802.md): The ManageJiraConnectors API in Atlassian Jira Align before version 10.109.2 allows remote attackers to exploit this issue to access interna (CVSS 4.9)
- [CVE-2022-36804](https://cve.now/CVE-2022-36804.md): Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, (CVSS 8.8, KEV)
- [CVE-2022-36801](https://cve.now/CVE-2022-36801.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref (CVSS 6.1)
- [CVE-2022-36800](https://cve.now/CVE-2022-36800.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission t (CVSS 4.3)
- [CVE-2022-36799](https://cve.now/CVE-2022-36799.md): This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. (CVSS 7.2)
- [CVE-2021-43959](https://cve.now/CVE-2021-43959.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of (no CVSS)
- [CVE-2020-36290](https://cve.now/CVE-2020-36290.md): The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befo (no CVSS)
- [CVE-2022-26138](https://cve.now/CVE-2022-26138.md): The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g (CVSS 9.8, KEV)
- [CVE-2022-26137](https://cve.now/CVE-2022-26137.md): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w (CVSS 8.8)
- [CVE-2022-26136](https://cve.now/CVE-2022-26136.md): A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p (CVSS 9.8)
- [CVE-2022-26135](https://cve.now/CVE-2022-26135.md): A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the si (CVSS 6.5)
- [CVE-2022-26134](https://cve.now/CVE-2022-26134.md): In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack (CVSS 9.8, KEV)
- [CVE-2022-26133](https://cve.now/CVE-2022-26133.md): SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6 (CVSS 9.8)
- [CVE-2022-0540](https://cve.now/CVE-2022-0540.md): A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques (CVSS 9.8)
- [CVE-2021-39114](https://cve.now/CVE-2021-39114.md): Affected versions of Atlassian Confluence Server and Data Center allow users with a valid account on a Confluence Data Center instance to ex (CVSS 8.8)
- [CVE-2021-43958](https://cve.now/CVE-2021-43958.md): Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest r (CVSS 9.8)
- [CVE-2021-43957](https://cve.now/CVE-2021-43957.md): Affected versions of Atlassian Fisheye & Crucible allowed remote attackers to browse local files via an Insecure Direct Object References (I (CVSS 7.5)
- [CVE-2021-43956](https://cve.now/CVE-2021-43956.md): The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or Java (no CVSS)
- [CVE-2021-43955](https://cve.now/CVE-2021-43955.md): The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain inf (no CVSS)
- [CVE-2021-43954](https://cve.now/CVE-2021-43954.md): The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository (no CVSS)
- [CVE-2021-43944](https://cve.now/CVE-2021-43944.md): This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. (CVSS 7.2)
- [CVE-2021-43945](https://cve.now/CVE-2021-43945.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrar (no CVSS)
- [CVE-2021-43943](https://cve.now/CVE-2021-43943.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitr (no CVSS)
- [CVE-2021-43948](https://cve.now/CVE-2021-43948.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of priv (no CVSS)
- [CVE-2021-43941](https://cve.now/CVE-2021-43941.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPag (no CVSS)
- [CVE-2021-43940](https://cve.now/CVE-2021-43940.md): Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the l (CVSS 7.8)
- [CVE-2021-43950](https://cve.now/CVE-2021-43950.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source con (no CVSS)
- [CVE-2021-43953](https://cve.now/CVE-2021-43953.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo (no CVSS)
- [CVE-2021-43952](https://cve.now/CVE-2021-43952.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fi (no CVSS)
- [CVE-2021-43949](https://cve.now/CVE-2021-43949.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects v (no CVSS)
- [CVE-2021-43951](https://cve.now/CVE-2021-43951.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import con (no CVSS)
- [CVE-2021-43947](https://cve.now/CVE-2021-43947.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code vi (CVSS 7.2)
- [CVE-2021-43946](https://cve.now/CVE-2021-43946.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscr (no CVSS)
- [CVE-2021-43942](https://cve.now/CVE-2021-43942.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro (no CVSS)
- [CVE-2021-41311](https://cve.now/CVE-2021-41311.md): Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access r (CVSS 7.5)
- [CVE-2021-41309](https://cve.now/CVE-2021-41309.md): Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export a (CVSS 5.3)
- [CVE-2021-41312](https://cve.now/CVE-2021-41312.md): Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Manage (CVSS 7.5)
- [CVE-2021-41310](https://cve.now/CVE-2021-41310.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro (no CVSS)
- [CVE-2021-41313](https://cve.now/CVE-2021-41313.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurat (no CVSS)
- [CVE-2021-41308](https://cve.now/CVE-2021-41308.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Repli (no CVSS)
- [CVE-2021-41307](https://cve.now/CVE-2021-41307.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and (CVSS 7.5)
- [CVE-2021-41306](https://cve.now/CVE-2021-41306.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an (CVSS 7.5)
- [CVE-2021-41305](https://cve.now/CVE-2021-41305.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filter (CVSS 7.5)
- [CVE-2021-41304](https://cve.now/CVE-2021-41304.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro (no CVSS)
- [CVE-2021-39126](https://cve.now/CVE-2021-39126.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forge (no CVSS)
- [CVE-2021-39127](https://cve.now/CVE-2021-39127.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken (CVSS 5.3)
- [CVE-2021-39128](https://cve.now/CVE-2021-39128.md): Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administr (CVSS 7.2)
- [CVE-2021-39125](https://cve.now/CVE-2021-39125.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumer (CVSS 5.3)
- [CVE-2019-20101](https://cve.now/CVE-2019-20101.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Cont (CVSS 5.3)
- [CVE-2021-39118](https://cve.now/CVE-2021-39118.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an e (CVSS 5.3)
- [CVE-2021-39123](https://cve.now/CVE-2021-39123.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability v (CVSS 7.5)
- [CVE-2021-39124](https://cve.now/CVE-2021-39124.md): The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote att (no CVSS)
- [CVE-2021-39122](https://cve.now/CVE-2021-39122.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclos (CVSS 5.3)
- [CVE-2021-39121](https://cve.now/CVE-2021-39121.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projec (no CVSS)
- [CVE-2021-39116](https://cve.now/CVE-2021-39116.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S (no CVSS)
- [CVE-2021-39115](https://cve.now/CVE-2021-39115.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to ex (CVSS 7.2)
- [CVE-2021-39119](https://cve.now/CVE-2021-39119.md): Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue (CVSS 5.3)
- [CVE-2021-39109](https://cve.now/CVE-2021-39109.md): The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path tra (CVSS 7.5)
- [CVE-2021-39117](https://cve.now/CVE-2021-39117.md): The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2021-39113](https://cve.now/CVE-2021-39113.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after lo (CVSS 7.5)
- [CVE-2021-39111](https://cve.now/CVE-2021-39111.md): The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before (no CVSS)
- [CVE-2021-26084](https://cve.now/CVE-2021-26084.md): In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack (CVSS 9.8, KEV)
- [CVE-2021-39112](https://cve.now/CVE-2021-39112.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp (no CVSS)
- [CVE-2021-26086](https://cve.now/CVE-2021-26086.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit (CVSS 5.3, KEV)
- [CVE-2021-26085](https://cve.now/CVE-2021-26085.md): Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File (CVSS 5.3, KEV)
- [CVE-2017-18113](https://cve.now/CVE-2017-18113.md): The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a sy (CVSS 8.8)
- [CVE-2020-36239](https://cve.now/CVE-2020-36239.md): Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b (CVSS 9.8)
- [CVE-2021-26083](https://cve.now/CVE-2021-26083.md): Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8 (no CVSS)
- [CVE-2021-26082](https://cve.now/CVE-2021-26082.md): The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14. (no CVSS)
- [CVE-2021-26081](https://cve.now/CVE-2021-26081.md): REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 befo (CVSS 5.3)
- [CVE-2021-26079](https://cve.now/CVE-2021-26079.md): The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, (no CVSS)
- [CVE-2021-26080](https://cve.now/CVE-2021-26080.md): EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8. (no CVSS)
- [CVE-2021-26078](https://cve.now/CVE-2021-26078.md): The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and (no CVSS)
- [CVE-2020-36289](https://cve.now/CVE-2020-36289.md): Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu (CVSS 5.3)
- [CVE-2021-26077](https://cve.now/CVE-2021-26077.md): Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian C (CVSS 9.1)
- [CVE-2020-29445](https://cve.now/CVE-2020-29445.md): Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and po (CVSS 4.3)
- [CVE-2020-29444](https://cve.now/CVE-2020-29444.md): Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Sit (CVSS 5.4)
- [CVE-2021-26074](https://cve.now/CVE-2021-26074.md): Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Ja (CVSS 6.5)
- [CVE-2021-26073](https://cve.now/CVE-2021-26073.md): Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js pac (CVSS 7.7)
- [CVE-2021-26076](https://cve.now/CVE-2021-26076.md): The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 befo (no CVSS)
- [CVE-2021-26075](https://cve.now/CVE-2021-26075.md): The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before (no CVSS)
- [CVE-2020-36288](https://cve.now/CVE-2020-36288.md): The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and fro (no CVSS)
- [CVE-2020-36287](https://cve.now/CVE-2020-36287.md): The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, an (no CVSS)
- [CVE-2021-26072](https://cve.now/CVE-2021-26072.md): The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the c (no CVSS)
- [CVE-2020-36286](https://cve.now/CVE-2020-36286.md): The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v (no CVSS)
- [CVE-2021-26071](https://cve.now/CVE-2021-26071.md): The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from (no CVSS)
- [CVE-2020-36238](https://cve.now/CVE-2020-36238.md): The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v (no CVSS)
- [CVE-2021-26069](https://cve.now/CVE-2021-26069.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate (no CVSS)
- [CVE-2021-26070](https://cve.now/CVE-2021-26070.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked reso (no CVSS)
- [CVE-2020-36240](https://cve.now/CVE-2020-36240.md): The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote atta (no CVSS)
- [CVE-2020-36232](https://cve.now/CVE-2020-36232.md): The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4 (no CVSS)
- [CVE-2021-26068](https://cve.now/CVE-2021-26068.md): An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2020-36233](https://cve.now/CVE-2020-36233.md): The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7 (no CVSS)
- [CVE-2020-29453](https://cve.now/CVE-2020-29453.md): The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8 (no CVSS)
- [CVE-2020-29448](https://cve.now/CVE-2020-29448.md): The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7 (no CVSS)
- [CVE-2020-29451](https://cve.now/CVE-2020-29451.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure v (no CVSS)
- [CVE-2020-36234](https://cve.now/CVE-2020-36234.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc (no CVSS)
- [CVE-2020-36237](https://cve.now/CVE-2020-36237.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Inform (no CVSS)
- [CVE-2020-36236](https://cve.now/CVE-2020-36236.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc (no CVSS)
- [CVE-2020-36235](https://cve.now/CVE-2020-36235.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names (no CVSS)
- [CVE-2020-14192](https://cve.now/CVE-2020-14192.md): Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabili (no CVSS)
- [CVE-2020-36231](https://cve.now/CVE-2020-36231.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access (no CVSS)
- [CVE-2021-26067](https://cve.now/CVE-2021-26067.md): Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home d (no CVSS)
- [CVE-2020-29450](https://cve.now/CVE-2020-29450.md): Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denia (no CVSS)
- [CVE-2020-29446](https://cve.now/CVE-2020-29446.md): Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDO (no CVSS)
- [CVE-2020-29447](https://cve.now/CVE-2020-29447.md): Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner (no CVSS)
- [CVE-2020-14193](https://cve.now/CVE-2020-14193.md): Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside th (no CVSS)
- [CVE-2020-14190](https://cve.now/CVE-2020-14190.md): Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. (no CVSS)
- [CVE-2020-14191](https://cve.now/CVE-2020-14191.md): Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS (no CVSS)
- [CVE-2020-14189](https://cve.now/CVE-2020-14189.md): The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2020-14188](https://cve.now/CVE-2020-14188.md): The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2020-14185](https://cve.now/CVE-2020-14185.md): Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the Actio (no CVSS)
- [CVE-2020-14184](https://cve.now/CVE-2020-14184.md): Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vu (no CVSS)
- [CVE-2020-14183](https://cve.now/CVE-2020-14183.md): Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support (no CVSS)
- [CVE-2019-20903](https://cve.now/CVE-2019-20903.md): The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScrip (no CVSS)
- [CVE-2019-20902](https://cve.now/CVE-2019-20902.md): Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. (no CVSS)
- [CVE-2020-14177](https://cve.now/CVE-2020-14177.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based (no CVSS)
- [CVE-2020-14180](https://cve.now/CVE-2020-14180.md): Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to (no CVSS)
- [CVE-2020-14179](https://cve.now/CVE-2020-14179.md): Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA (no CVSS)
- [CVE-2020-14181](https://cve.now/CVE-2020-14181.md): Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu (no CVSS)
- [CVE-2020-14178](https://cve.now/CVE-2020-14178.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vu (no CVSS)
- [CVE-2017-18112](https://cve.now/CVE-2017-18112.md): Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulner (no CVSS)
- [CVE-2020-14175](https://cve.now/CVE-2020-14175.md): Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-S (no CVSS)
- [CVE-2019-20901](https://cve.now/CVE-2019-20901.md): The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users t (no CVSS)
- [CVE-2020-14174](https://cve.now/CVE-2020-14174.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct (no CVSS)
- [CVE-2019-20900](https://cve.now/CVE-2019-20900.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc (no CVSS)
- [CVE-2019-20899](https://cve.now/CVE-2019-20899.md): The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated (no CVSS)
- [CVE-2019-20898](https://cve.now/CVE-2019-20898.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticate (no CVSS)
- [CVE-2019-20897](https://cve.now/CVE-2019-20897.md): The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service (no CVSS)
- [CVE-2020-14170](https://cve.now/CVE-2020-14170.md): Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netw (no CVSS)
- [CVE-2020-14171](https://cve.now/CVE-2020-14171.md): Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import reques (no CVSS)
- [CVE-2020-14173](https://cve.now/CVE-2020-14173.md): The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or Ja (no CVSS)
- [CVE-2020-14172](https://cve.now/CVE-2020-14172.md): This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implem (no CVSS)
- [CVE-2019-20419](https://cve.now/CVE-2019-20419.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerabilit (no CVSS)
- [CVE-2019-20418](https://cve.now/CVE-2019-20418.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Applic (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/atlassian
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.