Vulnerabilities > Atlassian > Jira > 7.13.10
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-01 | CVE-2020-14165 | Unspecified vulnerability in Atlassian Jira The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. | 5.3 |
| 2020-07-01 | CVE-2020-14164 | Cross-site Scripting vulnerability in Atlassian Jira The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. | 6.1 |
| 2020-07-01 | CVE-2019-20408 | Server-Side Request Forgery (SSRF) vulnerability in Atlassian Jira The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | 5.3 |
| 2020-06-30 | CVE-2019-20416 | Cross-site Scripting vulnerability in Atlassian Jira Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature. | 4.8 |
| 2020-06-23 | CVE-2020-4028 | Information Exposure Through Discrepancy vulnerability in Atlassian Jira Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this may have allowed unauthorised attackers to determine if certain resources exist or not through an Information Disclosure vulnerability. | 5.3 |
| 2020-06-23 | CVE-2019-20409 | Injection vulnerability in Atlassian Jira Software Data Center The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability. | 9.8 |
| 2020-06-01 | CVE-2020-4021 | Cross-site Scripting vulnerability in Atlassian products Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view. | 5.4 |
| 2020-02-12 | CVE-2019-20100 | Cross-Site Request Forgery (CSRF) vulnerability in Atlassian Jira The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). | 4.7 |
| 2020-02-06 | CVE-2019-20402 | Unspecified vulnerability in Atlassian Jira Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user to re-enter their password via an improper authorization vulnerability. | 4.9 |
| 2020-02-06 | CVE-2019-20106 | Incorrect Default Permissions vulnerability in Atlassian products Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows remote attackers to make comments on a ticket to which they do not have commenting permissions via a broken access control bug. | 4.3 |