Vulnerabilities > Atlassian > Jira Server > 8.6.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-06-01 | CVE-2020-4021 | Cross-site Scripting vulnerability in Atlassian products Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view. | 3.5 |
| 2020-03-17 | CVE-2019-20407 | Missing Authorization vulnerability in Atlassian Jira Data Center and Jira Server The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check. | 4.0 |
| 2020-02-12 | CVE-2019-20100 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). | 4.3 |
| 2020-02-12 | CVE-2019-20099 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). | 4.3 |
| 2020-02-12 | CVE-2019-20098 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). | 4.3 |
| 2020-02-06 | CVE-2019-20106 | Incorrect Default Permissions vulnerability in Atlassian products Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug. | 4.0 |