Atlassian Jira Data Center
64 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2019-15002 | unspecified – < 8.1.0 | An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a | MEDIUM 4.3 | 0.3 % | ||
| CVE-2022-36801 | unspecified – < 8.20.8 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Ref | MEDIUM 6.1 | 67 % | ||
| CVE-2022-36799 | unspecified – < 8.13.19 ; 8.14.0 – < unspecified ; unspecified – < 8.20.7 ; … | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af | HIGH 7.2 | 47 % | ||
| CVE-2021-43944 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Af | HIGH 7.2 | 2.3 % | ||
| CVE-2021-43945 | unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrar | MEDIUM 4.8 | 0.6 % | ||
| CVE-2021-43941 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPag | MEDIUM 6.5 | 0.6 % | ||
| CVE-2021-43953 | unspecified – < 8.13.16 ; next of 8.14.0 – < unspecified ; unspecified – < 8.20.5 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU mo | MEDIUM 4.3 | 0.5 % | ||
| CVE-2021-43952 | unspecified – < 8.21.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fi | MEDIUM 4.3 | 0.4 % | ||
| CVE-2021-43947 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code vi | HIGH 7.2 | 4.3 % | ||
| CVE-2021-43946 | unspecified – < 8.13.21 ; 8.14.0 – < unspecified ; unspecified – < 8.20.9 | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscr | MEDIUM 6.5 | 1.2 % | ||
| CVE-2021-43942 | unspecified – < 8.13.15 ; 8.14.0 – < unspecified ; unspecified – < 8.20.3 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro | MEDIUM 6.1 | 55 % | ||
| CVE-2021-41311 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access r | HIGH 7.5 | 0.9 % | ||
| CVE-2021-41309 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export a | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-41312 | unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Manage | HIGH 7.5 | 1.2 % | ||
| CVE-2021-41310 | unspecified – < 8.5.19 ; 8.6.0 – < unspecified ; unspecified – < 8.13.11 ; … | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro | MEDIUM 6.1 | 0.7 % | ||
| CVE-2021-41313 | unspecified – < 8.20.7 | Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurat | MEDIUM 4.3 | 0.9 % | ||
| CVE-2021-41308 | unspecified – < 8.6.0 ; 8.7.0 – < unspecified ; unspecified – < 8.13.12 ; … | Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Repli | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-41307 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and | HIGH 7.5 | 1.7 % | ||
| CVE-2021-41306 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.0 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an | HIGH 7.5 | 1.6 % | ||
| CVE-2021-41305 | unspecified – < 8.13.12 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filter | HIGH 7.5 | 1.2 % | ||
| CVE-2021-41304 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.20.2 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro | MEDIUM 6.1 | 0.9 % | ||
| CVE-2021-39126 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forge | MEDIUM 6.5 | 0.7 % | ||
| CVE-2021-39127 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-39128 | unspecified – < 8.13.12 ; 8.14.0 – < unspecified ; unspecified – < 8.19.1 | Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administr | HIGH 7.2 | 2.6 % | ||
| CVE-2021-39125 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumer | MEDIUM 5.3 | 1.9 % | ||
| CVE-2019-20101 | unspecified – < 8.13.3 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Cont | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-39118 | unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an e | MEDIUM 5.3 | 1.4 % | ||
| CVE-2021-39123 | unspecified – < 8.16.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability v | HIGH 7.5 | 1.6 % | ||
| CVE-2021-39124 | unspecified – < 8.16.0 | The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote att | MEDIUM 4.3 | 0.5 % | ||
| CVE-2021-39122 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclos | MEDIUM 5.3 | 1.9 % | ||
| CVE-2021-39121 | unspecified – < 8.5.18 ; 8.6.0 – < unspecified ; unspecified – < 8.13.10 ; … | Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projec | MEDIUM 4.3 | 1.6 % | ||
| CVE-2021-39116 | unspecified – < 8.13.14 ; 8.14.0 – < unspecified ; unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of S | MEDIUM 5.5 | 1.5 % | ||
| CVE-2021-39119 | unspecified – < 8.19.0 | Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-39117 | unspecified – < 8.18.0 | The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary | MEDIUM 4.8 | 0.6 % | ||
| CVE-2021-39113 | unspecified – < 8.13.9 ; 8.14.0 – < unspecified ; unspecified – < 8.18.0 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after lo | HIGH 7.5 | 2.5 % | ||
| CVE-2021-39111 | unspecified – < 8.5.18 ; 8.6.0 – < unspecified ; unspecified – < 8.13.10 ; … | The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before | MEDIUM 6.1 | 1.3 % | ||
| CVE-2021-39112 | unspecified – < 8.5.15 ; 8.6.0 – < unspecified ; unspecified – < 8.13.7 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp | MEDIUM 4.8 | 1.0 % | ||
| CVE-2021-26086 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit | MEDIUM 5.3 | 100 % | KEV | |
| CVE-2017-18113 | unspecified – < 8.18.1 | The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a sy | HIGH 8.8 | 1.8 % | ||
| CVE-2020-36239 | 6.3.0 – < unspecified ; unspecified – < 8.5.16 ; 8.6.0 – < unspecified ; … | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b | CRITICAL 9.8 | 50 % | ||
| CVE-2021-26083 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8 | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-26082 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14. | MEDIUM 5.4 | 1.0 % | ||
| CVE-2021-26081 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 befo | MEDIUM 5.3 | 1.2 % | ||
| CVE-2021-26079 | unspecified – < 8.5.15 ; 8.6.0 – < unspecified ; unspecified – < 8.13.7 ; … | The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, | MEDIUM 6.1 | 1.2 % | ||
| CVE-2021-26080 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8. | MEDIUM 6.1 | 1.3 % | ||
| CVE-2021-26078 | unspecified – < 8.5.14 ; 8.6.0 – < unspecified ; unspecified – < 8.13.6 ; … | The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and | MEDIUM 6.1 | 4.0 % | ||
| CVE-2020-36289 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vu | MEDIUM 5.3 | 99 % | ||
| CVE-2021-26076 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 befo | LOW 3.7 | 1.2 % | ||
| CVE-2021-26075 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before | MEDIUM 4.3 | 1.6 % | ||
| CVE-2020-36288 | unspecified – < 8.5.12 ; 8.6.0 – < unspecified ; unspecified – < 8.13.4 ; … | The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and fro | MEDIUM 6.1 | 1.5 % | ||
| CVE-2020-36287 | unspecified – < 8.13.5 ; 8.14.0 – < unspecified ; unspecified – < 8.15.1 | The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, an | MEDIUM 5.3 | 9.0 % | ||
| CVE-2020-36286 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v | MEDIUM 5.3 | 1.5 % | ||
| CVE-2021-26071 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from | LOW 3.5 | 0.5 % | ||
| CVE-2020-36238 | unspecified – < 8.5.13 ; 8.6.0 – < unspecified ; unspecified – < 8.13.5 ; … | The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from v | MEDIUM 5.3 | 1.6 % | ||
| CVE-2021-26069 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate | MEDIUM 5.3 | 2.7 % | ||
| CVE-2021-26070 | unspecified – < 8.13.3 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked reso | HIGH 7.2 | 1.9 % | ||
| CVE-2020-29453 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8 | MEDIUM 5.3 | 20 % | ||
| CVE-2020-29451 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure v | MEDIUM 4.3 | 0.9 % | ||
| CVE-2020-36234 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc | MEDIUM 4.8 | 1.1 % | ||
| CVE-2020-36237 | unspecified – < 8.15.0 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Inform | MEDIUM 5.3 | 1.2 % | ||
| CVE-2020-36236 | unspecified – < 8.5.11 ; 8.6.0 – < unspecified ; unspecified – < 8.13.3 ; … | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc | MEDIUM 6.1 | 1.3 % | ||
| CVE-2020-36235 | unspecified – < 8.13.2 ; 8.14.0 – < unspecified ; unspecified – < 8.14.1 | Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names | MEDIUM 5.3 | 2.0 % | ||
| CVE-2020-36231 | unspecified – < 8.5.10 ; 8.6.0 – < unspecified ; unspecified – < 8.13.2 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access | MEDIUM 4.3 | 1.2 % | ||
| CVE-2019-15001 | 7.0.10 – < unspecified ; unspecified – < 7.6.16 ; 7.7.0 – < unspecified ; … | The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0 | HIGH 7.2 | 11 % |