cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2023-22501,https://securityvulnerability.io/vulnerability/CVE-2023-22501,Impersonation Vulnerability in Jira Service Management by Atlassian,"An authentication flaw has been identified in Jira Service Management Server and Data Center which allows an attacker to impersonate legitimate users. Under specific conditions, particularly when write access is provided to a User Directory and outgoing email is active, attackers can exploit vulnerabilities to gain access to signup tokens for accounts that have never logged in. This can occur if the attacker interacts with Jira issues or requests a user is involved in, or if the attacker successfully intercepts emails with 'View Request' links sent to those users. Accounts with bot privileges and those associated with external single sign-on are especially vulnerable, making proper safeguards essential for maintaining user integrity.",Atlassian,"Jira Service Management Data Center,Jira Service Management Server",9.1,CRITICAL,0.002360000042244792,false,false,false,false,,false,false,2023-02-01T19:15:00.000Z,0
CVE-2022-36800,https://securityvulnerability.io/vulnerability/CVE-2022-36800,,"Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the ""Browse Users"" permission to view groups via an Information Disclosure vulnerability in the browsegroups.action endpoint. The affected versions are before version 4.22.2.",Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.3,MEDIUM,0.0008200000156648457,false,false,false,false,,false,false,2022-08-03T00:00:00.000Z,0
CVE-2021-43959,https://securityvulnerability.io/vulnerability/CVE-2021-43959,,"Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to access the content of internal network resources via a Server-Side Request Forgery (SSRF) vulnerability in the CSV importing feature of JSM Insight. When running in an environment like Amazon EC2, this flaw may be used to access to a metadata resource that provides access credentials and other potentially confidential information. The affected versions are before version 4.13.20, from version 4.14.0 before 4.20.8, and from version 4.21.0 before 4.22.2.",Atlassian,"Jira Service Management Server,Jira Service Management Data Center",5.7,MEDIUM,0.0016299999551847577,false,false,false,false,,false,false,2022-07-26T00:00:00.000Z,0
CVE-2022-26137,https://securityvulnerability.io/vulnerability/CVE-2022-26137,,"A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. Atlassian has confirmed and fixed the only known security issue associated with this vulnerability: Cross-origin resource sharing (CORS) bypass. Sending a specially crafted HTTP request can invoke the Servlet Filter used to respond to CORS requests, resulting in a CORS bypass. An attacker that can trick a user into requesting a malicious URL can access the vulnerable application with the victim’s permissions. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.",Atlassian,"Bamboo Server,Bamboo Data Center,Bitbucket Server,Bitbucket Data Center,Confluence Server,Confluence Data Center,Crowd Server,Crowd Data Center,Crucible,Fisheye,Jira Core Server,Jira Software Server,Jira Software Data Center,Jira Service Management Server,Jira Service Management Data Center",8.8,HIGH,0.0032999999821186066,false,false,false,false,,false,false,2022-07-20T00:00:00.000Z,0
CVE-2022-26136,https://securityvulnerability.io/vulnerability/CVE-2022-26136,,"A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.",Atlassian,"Bamboo Server,Bamboo Data Center,Bitbucket Server,Bitbucket Data Center,Confluence Server,Confluence Data Center,Crowd Server,Crowd Data Center,Crucible,Fisheye,Jira Core Server,Jira Software Server,Jira Software Data Center,Jira Service Management Server,Jira Service Management Data Center",9.8,CRITICAL,0.007739999797195196,false,false,false,false,,false,false,2022-07-20T00:00:00.000Z,0
CVE-2022-26135,https://securityvulnerability.io/vulnerability/CVE-2022-26135,,"A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. This affects Atlassian Jira Server and Data Center from version 8.0.0 before version 8.13.22, from version 8.14.0 before 8.20.10, from version 8.21.0 before 8.22.4. This also affects Jira Management Server and Data Center versions from version 4.0.0 before 4.13.22, from version 4.14.0 before 4.20.10 and from version 4.21.0 before 4.22.4.",Atlassian,"Jira Core Server,Jira Software Server,Jira Software Data Center,Jira Service Management Server,Jira Service Management Data Center",6.5,MEDIUM,0.027809999883174896,false,false,false,true,true,false,false,2022-06-30T06:15:00.000Z,0
CVE-2022-0540,https://securityvulnerability.io/vulnerability/CVE-2022-0540,,"A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.",Atlassian,"Jira Core Server,Jira Software Server,Jira Software Data Center,Jira Service Management Server,Jira Service Management Data Center",9.8,CRITICAL,0.12830999493598938,false,false,false,true,true,false,false,2022-04-20T00:00:00.000Z,0
CVE-2021-43943,https://securityvulnerability.io/vulnerability/CVE-2021-43943,,"Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ""Object Schema"" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0.",Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.8,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2022-02-24T05:15:00.000Z,0
CVE-2021-43948,https://securityvulnerability.io/vulnerability/CVE-2021-43948,,"Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of private objects via an Improper Authorization vulnerability in the ""Move objects"" feature. The affected versions are before version 4.21.0.",Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.3,MEDIUM,0.0008200000156648457,false,false,false,false,,false,false,2022-02-15T04:15:00.000Z,0
CVE-2021-43950,https://securityvulnerability.io/vulnerability/CVE-2021-43950,,Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source configuration information via a Broken Access Control vulnerability in the Insight Import Source feature. The affected versions are before version 4.21.0.,Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.3,MEDIUM,0.0008200000156648457,false,false,false,false,,false,false,2022-02-15T03:15:00.000Z,0
CVE-2021-43951,https://securityvulnerability.io/vulnerability/CVE-2021-43951,,Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import configuration details via an Information Disclosure vulnerability in the Create Object type mapping feature. The affected versions are before version 4.21.0.,Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.3,MEDIUM,0.0008200000156648457,false,false,false,false,,false,false,2022-01-10T16:15:00.000Z,0
CVE-2021-43949,https://securityvulnerability.io/vulnerability/CVE-2021-43949,,Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects via a Broken Access Control vulnerability in the Custom Fields feature. The affected versions are before version 4.21.0.,Atlassian,"Jira Service Management Server,Jira Service Management Data Center",4.3,MEDIUM,0.0008200000156648457,false,false,false,false,,false,false,2022-01-10T16:15:00.000Z,0