Skip to content
OpenAdvisories
Medium WID-SEC-2024-3507 2 CVEs

Atlassian Jira Software: Mehrere Schwachstellen

Published Nov 19, 2024 · Updated Mar 17, 2026 · Revision 3 · de-DE

Vendor: Atlassian Product: Crucible Product: Jira Product: Jira Software Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Jira Software ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen und einen Cross-Site-Scripting-Angriff durchzuführen.

Product

Jira ist eine Webanwendung zur Softwareentwicklung.

Vulnerabilities 2

  • High 7.5
    CVE-2023-52428

    Denial of Service in Connect2id Nimbus JOSE+JWT

    In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

    druid thingsboard-tb-node thingsboard-tb-mqtt-transport tez Wolfi Maven
  • High 7.3
    CVE-2024-45801

    Tampering by prototype polution in DOMPurify

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

    cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm

Revision history

  1. #3

    Neue Updates aufgenommen

  2. #2

    Neue Updates aufgenommen

  3. #1

    Initiale Fassung

References