Vulnerabilities in Atlassian
409 resultsCVE-2019-15009—The /json/profile/removeStarAjax.do resource in Atlassian Fisheye and Crucible before version 4.8.0 allows remote attackers to remove anotheEPSS 0.7%CVE-2021-43956—The jQuery deserialize library in Fisheye and Crucible before version 4.8.9 allowed remote attackers to to inject arbitrary HTML and/or JavaEPSS 0.7%CVE-2021-39126—Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request ForgeEPSS 0.7%CVE-2021-43959—Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of EPSS 0.7%CVE-2021-41310—Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroEPSS 0.7%CVE-2020-36290—The Livesearch macro in Confluence Server and Data Center before version 7.4.5, from version 7.5.0 before 7.6.3, and from version 7.7.0 befoEPSS 0.7%CVE-2025-22157HIGHThis High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions:
9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira CoreEPSS 0.7%CVE-2017-16865—The Trello importer in Atlassian Jira before version 7.6.1 allows remote attackers to access the content of internal network resources via aEPSS 0.7%CVE-2022-36803HIGHThe MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissiEPSS 0.7%CVE-2019-20411—Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgEPSS 0.7%CVE-2019-11586—The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versioEPSS 0.7%CVE-2019-8447—The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site rEPSS 0.7%CVE-2017-16862—The IncomingMailServers resource in Atlassian Jira before version 7.6.2 allows remote attackers to modify the "incoming mail" whitelist settEPSS 0.7%CVE-2021-26074MEDIUMBroken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a JaEPSS 0.7%CVE-2017-18042—The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwEPSS 0.7%CVE-2017-9513—Several rest inline action resources of Atlassian Activity Streams before version 6.3.0 allows remote authenticated attackers to watch any CEPSS 0.7%CVE-2019-20415—Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-siteEPSS 0.7%CVE-2022-36800MEDIUMAffected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission tEPSS 0.7%CVE-2017-18089—The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers EPSS 0.6%CVE-2017-18092—The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackersEPSS 0.6%