Vulnerabilities in Atlassian
409 resultsCVE-2020-14173—The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JaEPSS 0.9%CVE-2017-18036—The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they couEPSS 0.9%CVE-2019-8450—Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackeEPSS 0.9%CVE-2020-14192—Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabiliEPSS 0.9%CVE-2021-41304—Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroEPSS 0.9%CVE-2021-43955—The /rest-service-fecru/server-v1 resource in Fisheye and Crucible before version 4.8.9 allowed authenticated remote attackers to obtain infEPSS 0.9%CVE-2019-20902—Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from before version 3.4.6 and EPSS 0.9%CVE-2017-16860—The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7, from version 5.3.0 before version 5.3.4 and from versioEPSS 0.9%CVE-2021-41313—Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratEPSS 0.9%CVE-2021-41311HIGHAffected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access rEPSS 0.9%CVE-2018-13388—The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JaEPSS 0.9%CVE-2017-14587—The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitraryEPSS 0.9%CVE-2017-18098—The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cEPSS 0.9%CVE-2017-18090—Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers toEPSS 0.9%CVE-2020-14180—Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to EPSS 0.8%CVE-2018-20826—The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missEPSS 0.8%CVE-2021-43948—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privEPSS 0.8%CVE-2019-20419—Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerabilitEPSS 0.8%CVE-2021-43950—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source conEPSS 0.8%CVE-2017-18091—The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allowsEPSS 0.8%