Vulnerabilities > Atlassian > Jira > 8.3.4
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-03 | CVE-2020-14172 | Deserialization of Untrusted Data vulnerability in Atlassian Jira and Jira Software Data Center This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. | 7.5 |
| 2020-07-03 | CVE-2019-20418 | Unspecified vulnerability in Atlassian Jira and Jira Software Data Center Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. | 4.0 |
| 2020-07-01 | CVE-2020-4029 | Unspecified vulnerability in Atlassian products The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability. | 4.0 |
| 2020-07-01 | CVE-2020-4025 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type. | 3.5 |
| 2020-07-01 | CVE-2020-4024 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type. | 3.5 |
| 2020-07-01 | CVE-2020-4022 | Cross-site Scripting vulnerability in Atlassian products The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type. | 4.3 |
| 2020-07-01 | CVE-2020-14169 | Cross-site Scripting vulnerability in Atlassian Jira The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability | 4.3 |
| 2020-07-01 | CVE-2020-14165 | Incorrect Authorization vulnerability in Atlassian Jira The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability. | 5.0 |
| 2020-07-01 | CVE-2020-14164 | Cross-site Scripting vulnerability in Atlassian Jira The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field. | 4.3 |
| 2020-07-01 | CVE-2019-20408 | Server-Side Request Forgery (SSRF) vulnerability in Atlassian Jira The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. | 5.0 |