Skip to content
OpenAdvisories

Vendor

Atlassian

409 known vulnerabilities.

Products

Jira Server 99 Jira Data Center 64 Jira 52 Confluence Server 39 Confluence Data Center 39 Crucible 27 Fisheye 25 Bitbucket Server 18 Jira Service Management Data Center 16 Fisheye and Crucible 16 Bitbucket Data Center 14 Jira Server and Data Center 14 Jira Align 13 Crowd 13 Jira Service Management Server 13 Bamboo 12 Bamboo Data Center 10 Sourcetree for Windows 8 Crowd Data Center 7 Jira Software Data Center 7 Bamboo Server 6 Confluence 6 Jira Service Desk Server 5 Jira Software Server 5 Application Links 5 Jira Core Server 5 Atlassian Fisheye and Crucible 5 Jira Service Desk Data Center 4 Crowd Server 4 Sourcetree for macOS 4 Sourcetree for Mac 4 Atlassian Application Links 3 Jira Core Data Center 3 Universal Plugin Manager 3 Confluence Questions 2 Atlassian Crucible 2 Assets Discovery Data Center 2 Companion App 2 Atlassian Connect Spring Boot (ACSB) 2 Atlassian Fisheye 1
All Critical High Medium Low Exploited only Public exploit

409 results · Feed

  • Unscored —
    CVE-2019-8447

    The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export fil…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-14999

    The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before ver…

    Atlassian Universal Plugin Manager
  • Unscored —
    CVE-2019-8448

    The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attacke…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20826

    The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20827

    The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript…

    Atlassian Jira Web / CMS
  • Critical 9.8
    CVE-2019-11581 Exploited Public exploit Scanner template EPSS 85%

    There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…

    Atlassian Jira Server and Data Center Web / CMS
    KEV Mar 7, 2022
  • Unscored —
    CVE-2019-11583

    The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via d…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-11582

    An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3,…

    Atlassian Sourcetree for Windows Windows
  • Unscored —
    CVE-2019-3397

    Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.…

    Atlassian Bitbucket Data Center
  • Critical 9.8
    CVE-2019-11580 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Atta…

    Atlassian Crowd
    KEV Nov 3, 2021
  • Unscored —
    CVE-2019-8442 Scanner template EPSS 60%

    The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3402 Scanner template

    The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-8443

    The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3403 Public exploit Scanner template EPSS 54%

    The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and f…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3401 Scanner template EPSS 14%

    The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20824 Scanner template EPSS 38%

    The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScr…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2019-3400

    The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20239

    Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from versio…

    Atlassian Atlassian Application Links
  • Unscored —
    CVE-2019-3399

    The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remo…

    Atlassian Jira Web / CMS
  • High 8.8
    CVE-2019-3398 Exploited Public exploit Scanner template EPSS 97%

    Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote a…

    Atlassian Confluence Web / CMS
    KEV Nov 3, 2021
  • Unscored —
    CVE-2017-18106

    The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an ident…

    Atlassian Crowd
  • Unscored —
    CVE-2017-18110

    The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before versio…

    Atlassian Crowd
  • Unscored —
    CVE-2017-18111

    The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from…

    Atlassian Application Links
  • Unscored —
    CVE-2017-18109

    The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allow…

    Atlassian Crowd
  • Unscored —
    CVE-2017-18105

    The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows r…

    Atlassian Crowd
  • Unscored —
    CVE-2017-18108

    The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with ad…

    Atlassian Crowd
  • Unscored —
    CVE-2019-3395

    The WebDAV endpoint in Atlassian Confluence Server and Data Center before version 6.6.7 (the fixed version for 6.6.x), …

    Atlassian Confluence Server Web / CMS
  • Critical 9.8
    CVE-2019-3396 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from ver…

    Atlassian Confluence Server Web / CMS
    KEV Nov 3, 2021
  • Unscored —
    CVE-2018-20234

    There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 v…

    Atlassian Sourcetree for macOS macOS
  • Unscored —
    CVE-2018-20236

    There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI …

    Atlassian Sourcetree for Windows Windows
  • Unscored —
    CVE-2018-20235

    There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.…

    Atlassian Sourcetree for Windows Windows
  • Unscored —
    CVE-2018-20241

    The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to…

    Atlassian Fisheye and Crucible
  • Unscored —
    CVE-2018-20240

    The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers …

    Atlassian Fisheye and Crucible
  • Unscored —
    CVE-2018-13404

    The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-13403

    The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20237

    Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted pa…

    Atlassian Confluence Server Confluence Data Center Web / CMS
  • Unscored —
    CVE-2018-20238

    Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote…

    Atlassian Crowd
  • Unscored —
    CVE-2018-20232

    The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows re…

    Atlassian Jira Web / CMS
  • Unscored —
    CVE-2018-20233

    The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who hav…

    Atlassian Universal Plugin Manager
  • Unscored —
    CVE-2018-13397

    There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via G…

    Atlassian Sourcetree for Windows Windows