Jira Data Center (Atlassian) - vulnerabilities (CVEs)

92 CVEs, 1 in the last 30 days, 395 known versions, newest CVE from 2026-10-05. Vendor: Atlassian.

CVEs of Jira Data Center

• CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
• CVE-2025-22167 - CVSS 8.7 (high), 2025-10-22: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software…
• CVE-2025-22157 - CVSS 8.8 (high), 2025-05-20: This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and…
• CVE-2019-15002 - CVSS 4.3 (medium), 2025-02-11: An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an…
• CVE-2024-21685 - CVSS 7.4 (high), 2024-06-18: This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information…
• CVE-2024-21683 - CVSS 8.8 (high), 2024-05-21: This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. This RCE (Remote Code…
• CVE-2022-36801 - CVSS 6.1 (medium), 2022-08-10: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site…
• CVE-2022-36799 - CVSS 7.2 (high), 2022-08-01: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of…
• CVE-2022-26137 - CVSS 8.8 (high), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the…
• CVE-2022-26136 - CVSS 9.8 (critical), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The…
• CVE-2022-26135 - CVSS 6.5 (medium), 2022-06-30: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to…
• CVE-2022-0540 - CVSS 9.8 (critical), 2022-04-20: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects…
• CVE-2021-43944 - CVSS 7.2 (high), 2022-03-08: This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of…
• CVE-2021-43945 - CVSS 4.8 (medium), 2022-02-28: Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or…
• CVE-2021-43941 - CVSS 6.5 (medium), 2022-02-15: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPage.jspa and…
• CVE-2021-43953 - CVSS 4.3 (medium), 2022-02-15: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings…
• CVE-2021-43952 - CVSS 4.3 (medium), 2022-02-15: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default configuration of fields via a…
• CVE-2021-43947 - CVSS 7.2 (high), 2022-01-06: Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code via a Remote Code…
• CVE-2021-43946 - CVSS 6.5 (medium), 2022-01-05: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscriptions via a…
• CVE-2021-43942 - CVSS 6.1 (medium), 2022-01-04: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting…
• CVE-2021-41311 - CVSS 7.5 (high), 2021-12-08: Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify…
• CVE-2021-41309 - CVSS 5.3 (medium), 2021-12-08: Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of…
• CVE-2021-41312 - CVSS 7.5 (high), 2021-11-03: Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Management to enable and…
• CVE-2021-41310 - CVSS 6.1 (medium), 2021-11-01: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting…
• CVE-2021-41313 - CVSS 4.3 (medium), 2021-11-01: Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurations via an…
• CVE-2021-41305 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure…
• CVE-2021-41308 - CVSS 6.5 (medium), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings…
• CVE-2021-41307 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters…
• CVE-2021-41306 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct…
• CVE-2021-41304 - CVSS 6.1 (medium), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting…
• CVE-2021-39127 - CVSS 5.3 (medium), 2021-10-21: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control…
• CVE-2021-39126 - CVSS 6.5 (medium), 2021-10-21: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery (CSRF)…
• CVE-2021-39128 - CVSS 7.2 (high), 2021-09-16: Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to…
• CVE-2021-39125 - CVSS 5.3 (medium), 2021-09-14: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumeration…
• CVE-2021-39124 - CVSS 4.3 (medium), 2021-09-14: The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attackers who are…
• CVE-2021-39123 - CVSS 7.5 (high), 2021-09-14: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability via a Denial of…
• CVE-2021-39118 - CVSS 5.3 (medium), 2021-09-14: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an enumeration…
• CVE-2019-20101 - CVSS 5.3 (medium), 2021-09-14: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Control vulnerability…
• CVE-2021-39122 - CVSS 5.3 (medium), 2021-09-08: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view users' emails via an Information Disclosure vulnerability…
• CVE-2021-39121 - CVSS 4.3 (medium), 2021-09-08: Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to enumerate the keys of private Jira projects via an…
• CVE-2021-39116 - CVSS 5.5 (medium), 2021-09-08: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)…
• CVE-2021-39119 - CVSS 5.3 (medium), 2021-09-01: Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue even after their…
• CVE-2021-39111 - CVSS 6.1 (medium), 2021-08-30: The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows…
• CVE-2021-39117 - CVSS 4.8 (medium), 2021-08-30: The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript…
• CVE-2021-39113 - CVSS 7.5 (high), 2021-08-30: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions,…
• CVE-2021-39112 - CVSS 4.8 (medium), 2021-08-25: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability…
• CVE-2021-26086 - CVSS 5.3 (medium), 2021-08-16: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the…
• CVE-2017-18113 - CVSS 8.8 (high), 2021-08-02: The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator…
• CVE-2020-36239 - CVSS 9.8 (critical), 2021-07-29: Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and…
• CVE-2021-26083 - CVSS 5.4 (medium), 2021-07-20: Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before…
• CVE-2021-26082 - CVSS 5.4 (medium), 2021-07-20: The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0…
• CVE-2021-26081 - CVSS 5.3 (medium), 2021-07-20: REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows…
• CVE-2021-26078 - CVSS 6.1 (medium), 2021-06-07: The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version…
• CVE-2021-26080 - CVSS 6.1 (medium), 2021-06-07: EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1…
• CVE-2021-26079 - CVSS 6.1 (medium), 2021-06-07: The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version…
• CVE-2020-36289 - CVSS 5.3 (medium), 2021-05-12: Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the…
• CVE-2021-26075 - CVSS 4.3 (medium), 2021-04-15: The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from…
• CVE-2020-36288 - CVSS 6.1 (medium), 2021-04-15: The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0…
• CVE-2021-26076 - CVSS 3.7 (low), 2021-04-15: The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4,…
• CVE-2020-36287 - CVSS 5.3 (medium), 2021-04-09: The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version…
• CVE-2021-26071 - CVSS 3.5 (low), 2021-04-01: The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0…
• CVE-2020-36286 - CVSS 5.3 (medium), 2021-04-01: The membersOf JQL search function in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0…
• CVE-2020-36238 - CVSS 5.3 (medium), 2021-04-01: The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0…
• CVE-2021-26070 - CVSS 7.2 (high), 2021-03-22: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken…
• CVE-2021-26069 - CVSS 5.3 (medium), 2021-03-22: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via…
• CVE-2020-29453 - CVSS 5.3 (medium), 2021-02-22: The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8.14.0 before…
• CVE-2020-29451 - CVSS 4.3 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in…
• CVE-2020-36234 - CVSS 4.8 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)…
• CVE-2020-36237 - CVSS 5.3 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure…
• CVE-2020-36236 - CVSS 6.1 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)…
• CVE-2020-36235 - CVSS 5.3 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information…
• CVE-2020-36231 - CVSS 4.3 (medium), 2021-02-02: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an…
• CVE-2020-14179 - CVSS 5.3 (medium), 2020-09-21: Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an…
• CVE-2020-14178 - CVSS 7.5 (high), 2020-09-01: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the…
• CVE-2020-14174 - CVSS 4.3 (medium), 2020-07-13: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References…
• CVE-2019-20900 - CVSS 4.8 (medium), 2020-07-13: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
• CVE-2019-20899 - CVSS 5.3 (medium), 2020-07-13: The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a…
• CVE-2019-20897 - CVSS 6.5 (medium), 2020-07-13: The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG…
• CVE-2020-14173 - CVSS 5.4 (medium), 2020-07-03: The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a…
• CVE-2019-20419 - CVSS 7.8 (high), 2020-07-03: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The…
• CVE-2020-4022 - CVSS 6.1 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote…
• CVE-2020-4029 - CVSS 4.3 (medium), 2020-07-01: The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0…
• CVE-2020-4025 - CVSS 4.8 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before…
• CVE-2020-4024 - CVSS 5.4 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote…
• CVE-2020-14168 - CVSS 5.9 (medium), 2020-07-01: The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows…
• CVE-2020-14167 - CVSS 7.5 (high), 2020-07-01: The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0…
• CVE-2019-20415 - CVSS 4.3 (medium), 2020-06-30: Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery…
• CVE-2019-20414 - CVSS 5.4 (medium), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
• CVE-2019-20412 - CVSS 5.3 (medium), 2020-06-29: The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information…
• CVE-2019-20411 - CVSS 4.3 (medium), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify Wallboard settings via a Cross-site request forgery (CSRF)…
• CVE-2019-20410 - CVSS 6.5 (medium), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in…
• CVE-2019-20413 - CVSS 7.5 (high), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)…
• CVE-2020-4021 - CVSS 5.4 (medium), 2020-06-01: Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or…
• CVE-2019-20407 - CVSS 4.3 (medium), 2020-03-17: The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release…
• CVE-2019-20098 - CVSS 4.3 (medium), 2020-02-12: The VerifySmtpServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery…
• CVE-2019-20100 - CVSS 4.7 (medium), 2020-02-12: The Atlassian Application Links plugin is vulnerable to cross-site request forgery (CSRF). The following versions are affected: all versions prior to 5.4.21,…
• CVE-2019-20099 - CVSS 4.3 (medium), 2020-02-12: The VerifyPopServerConnection!add.jspa component in Atlassian Jira Server and Data Center before version 8.7.0 is vulnerable to cross-site request forgery…
• CVE-2019-20403 - CVSS 5.3 (medium), 2020-02-06: The API in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to determine if a Jira project key exists or not via an…
• CVE-2019-20106 - CVSS 4.3 (medium), 2020-02-06: Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows…
• CVE-2019-20405 - CVSS 4.3 (medium), 2020-02-06: The JMX monitoring flag in Atlassian Jira Server and Data Center before version 8.6.0 allows remote attackers to turn the JMX monitoring flag off or on via a…