Atlassian vulnerabilities
409 CVEs and advisories name Atlassian as an affected vendor, 14 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-14164The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScri
- CVE-2019-20408The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal net
- CVE-2019-20416Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc
- CVE-2019-20415Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site
- CVE-2019-20414Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site sc
- CVE-2019-20413Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S
- CVE-2019-20412The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the fol
- CVE-2019-20411Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forg
- CVE-2019-20410Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosur
- CVE-2020-4028Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in som
- CVE-2019-20409The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to ga
- CVE-2020-4026The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from v
- CVE-2020-4023The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Java
- CVE-2020-4021Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject a
- CVE-2020-4020The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Ser
- CVE-2020-4019The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different ex
- CVE-2020-4018The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross
- CVE-2020-4017The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 al
- CVE-2020-4016The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows r
- CVE-2020-4015The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user e
- CVE-2020-4014The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's
- CVE-2020-4013The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript vi
- CVE-2019-20102The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3, and version 6.15.0 before versio
- CVE-2019-20407The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attacker
- CVE-2019-20105The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, f
- CVE-2019-20100The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF).
- CVE-2019-20099The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site r
- CVE-2019-20098The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site
- CVE-2019-20406The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.
- CVE-2019-20405The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring fla