Jira Software Data Center (Atlassian) - vulnerabilities (CVEs)

39 CVEs, 1 in the last 30 days, 205 known versions, newest CVE from 2026-10-05. Vendor: Atlassian.

CVEs of Jira Software Data Center

CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
CVE-2025-22167 - CVSS 8.7 (high), 2025-10-22: This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software…
CVE-2022-26137 - CVSS 8.8 (high), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the…
CVE-2022-26136 - CVSS 9.8 (critical), 2022-07-20: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The…
CVE-2022-26135 - CVSS 6.5 (medium), 2022-06-30: A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to…
CVE-2022-0540 - CVSS 9.8 (critical), 2022-04-20: A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects…
CVE-2021-41309 - CVSS 5.3 (medium), 2021-12-08: Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of…
CVE-2021-41311 - CVSS 7.5 (high), 2021-12-08: Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access revoked to modify…
CVE-2021-41310 - CVSS 6.1 (medium), 2021-11-01: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting…
CVE-2021-41307 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters…
CVE-2021-41306 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct…
CVE-2021-41305 - CVSS 7.5 (high), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure…
CVE-2021-41308 - CVSS 6.5 (medium), 2021-10-26: Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Replication settings…
CVE-2021-39127 - CVSS 5.3 (medium), 2021-10-21: Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control…
CVE-2020-36239 - CVSS 9.8 (critical), 2021-07-29: Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and…
CVE-2020-36236 - CVSS 6.1 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS)…
CVE-2020-36235 - CVSS 5.3 (medium), 2021-02-15: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information…
CVE-2020-36231 - CVSS 4.3 (medium), 2021-02-02: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access to via an…
CVE-2020-14178 - CVSS 7.5 (high), 2020-09-01: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vulnerability in the…
CVE-2020-14174 - CVSS 4.3 (medium), 2020-07-13: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References…
CVE-2019-20898 - CVSS 7.5 (high), 2020-07-13: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global…
CVE-2019-20899 - CVSS 5.3 (medium), 2020-07-13: The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a…
CVE-2019-20897 - CVSS 6.5 (medium), 2020-07-13: The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG…
CVE-2020-14172 - CVSS 9.8 (critical), 2020-07-03: This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in…
CVE-2020-14173 - CVSS 5.4 (medium), 2020-07-03: The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a…
CVE-2019-20418 - CVSS 6.5 (medium), 2020-07-03: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of…
CVE-2020-4025 - CVSS 4.8 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before…
CVE-2020-4024 - CVSS 5.4 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote…
CVE-2020-4022 - CVSS 6.1 (medium), 2020-07-01: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote…
CVE-2020-4029 - CVSS 4.3 (medium), 2020-07-01: The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0…
CVE-2020-14169 - CVSS 6.1 (medium), 2020-07-01: The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a…
CVE-2020-14164 - CVSS 6.1 (medium), 2020-07-01: The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an…
CVE-2020-14168 - CVSS 5.9 (medium), 2020-07-01: The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows…
CVE-2020-14167 - CVSS 7.5 (high), 2020-07-01: The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0…
CVE-2020-14165 - CVSS 5.3 (medium), 2020-07-01: The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom…
CVE-2019-20416 - CVSS 4.8 (medium), 2020-06-30: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
CVE-2019-20415 - CVSS 4.3 (medium), 2020-06-30: Atlassian Jira Server and Data Center in affected versions allows remote attackers to modify logging and profiling settings via a cross-site request forgery…
CVE-2019-20414 - CVSS 5.4 (medium), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS)…
CVE-2019-20410 - CVSS 6.5 (medium), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view sensitive information via an Information Disclosure vulnerability in…
CVE-2019-20413 - CVSS 7.5 (high), 2020-06-29: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS)…
CVE-2019-20412 - CVSS 5.3 (medium), 2020-06-29: The Convert Sub-Task to Issue page in affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate the following information…
CVE-2020-4028 - CVSS 5.3 (medium), 2020-06-23: Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in some situations this…
CVE-2019-20409 - CVSS 9.8 (critical), 2020-06-23: The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code…
CVE-2020-4021 - CVSS 5.4 (medium), 2020-06-01: Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or…
CVE-2019-20402 - CVSS 4.9 (medium), 2020-02-06: Support zip files in Atlassian Jira Server and Data Center before version 8.6.0 could be downloaded by a System Administrator user without requiring the user…
CVE-2019-20106 - CVSS 4.3 (medium), 2020-02-06: Comment properties in Atlassian Jira Server and Data Center before version 7.13.12, from 8.0.0 before version 8.5.4, and 8.6.0 before version 8.6.1 allows…