Vulnerabilities > Atlassian > Jira Server > 8.6.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-01 | CVE-2020-4025 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type. | 4.8 |
| 2020-07-01 | CVE-2020-4024 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type. | 5.4 |
| 2020-07-01 | CVE-2020-4022 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type. | 6.1 |
| 2020-06-01 | CVE-2020-4021 | Cross-site Scripting vulnerability in Atlassian products Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view. | 5.4 |
| 2020-02-12 | CVE-2019-20100 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). | 4.7 |
| 2020-02-12 | CVE-2019-20099 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). | 4.3 |
| 2020-02-12 | CVE-2019-20098 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery (CSRF). | 4.3 |
| 2020-02-06 | CVE-2019-20404 | Unspecified vulnerability in Atlassian Jira Data Center and Jira Server The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. | 4.3 |