Vulnerabilities > Atlassian > Jira Server
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-02-06 | CVE-2019-20405 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a Cross-site request forgery (CSRF) vulnerability. | 4.3 |
| 2020-02-06 | CVE-2019-20404 | Unspecified vulnerability in Atlassian Jira Data Center and Jira Server The API in Atlassian Jira Server and Data Center before version 8.6.0 allows authenticated remote attackers to determine project titles they do not have access to via an improper authorization vulnerability. | 4.3 |
| 2020-02-06 | CVE-2019-20403 | Unspecified vulnerability in Atlassian Jira Server The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an information disclosure vulnerability. | 5.3 |
| 2020-02-06 | CVE-2019-20401 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira Server Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery (CSRF) vulnerabilities. | 6.5 |
| 2020-02-06 | CVE-2019-20400 | Uncontrolled Search Path Element vulnerability in Atlassian Jira Server The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. | 7.8 |
| 2020-02-06 | CVE-2019-20106 | Incorrect Default Permissions vulnerability in Atlassian products Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug. | 4.3 |
| 2019-12-18 | CVE-2019-15013 | Missing Authorization vulnerability in Atlassian Jira The WorkflowResource class removeStatus method in Jira before version 7.13.12, from version 8.0.0 before version 8.4.3, and from version 8.5.0 before version 8.5.2 allows authenticated remote attackers who do not have project administration access to remove a configured issue status from a project via a missing authorisation check. | 4.3 |
| 2019-09-19 | CVE-2019-15001 | Code Injection vulnerability in Atlassian Jira Server The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request. | 7.2 |
| 2019-09-11 | CVE-2019-8451 | Server-Side Request Forgery (SSRF) vulnerability in Atlassian Jira Server The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | 6.5 |
| 2019-09-11 | CVE-2019-8450 | Cross-site Scripting vulnerability in Atlassian Jira Server Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field. | 4.8 |