Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2726▼ 504 respecto a la semana anterior
Críticas / altas1294▼ 196 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)229▼ 273 respecto a la semana anterior
293 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Crítica (9.8) | 16% | 💥 PoC | Softwareag QuartzOracle Apache Batik MapviewerOracle Banking Enterprise OriginationsOracle Banking Enterprise Product Manufacturing+27 | 26/7/2019 | 17/6/2026 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. | |
| Modificada | Media (6.5) | 1.5% | — | Atlassian Jira | 26/6/2019 | 17/6/2026 | The issue searching component in Jira before version 8.1.0 allows remote attackers to deny access to Jira service via denial of service vulnerability in issue search when ordering by "Epic Name". | |
| Modificada | Alta (8.1) | 2.6% | — | Atlassian JiraAtlassian Jira Server | 22/5/2019 | 17/6/2026 | The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass… | |
| Modificada | Alta (7.5) | 60% | 💥 Exploit | Atlassian JiraAtlassian Jira Server | 22/5/2019 | 17/6/2026 | The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check. | |
| Modificada | Media (5.3) | 53% | 💥 Exploit | Atlassian JiraAtlassian Jira Server | 22/5/2019 | 17/6/2026 | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. | |
| Modificada | Media (6.1) | 8.9% | 💥 Exploit | Atlassian JiraAtlassian Jira Server | 22/5/2019 | 17/6/2026 | The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter. | |
| Modificada | Media (5.3) | 13% | 💥 Exploit | Atlassian JiraAtlassian Jira Server | 22/5/2019 | 17/6/2026 | The ManageFilters.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. | |
| Modificada | Media (6.1) | 1.1% | — | Atlassian Jira Server | 3/5/2019 | 17/6/2026 | The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter. | |
| Modificada | Media (6.1) | 38% | 💥 Exploit | Atlassian Jira | 3/5/2019 | 17/6/2026 | The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter. | |
| Modificada | Alta (7.5) | 2.1% | — | Atlassian JiraAtlassian Jira Server | 30/4/2019 | 17/6/2026 | The BrowseProjects.jspa resource in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to see information for archived projects through a missing authorisation check. | |
| Modificada | Media (5.4) | 3.3% | — | Atlassian Application LinksAtlassian Confluence Data CenterAtlassian Confluence ServerAtlassian Crowd+4 | 30/4/2019 | 17/6/2026 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl… | |
| Modificada | Alta (8.8) | 1.3% | — | Jenkins Jira-ext | 18/4/2019 | 17/6/2026 | Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system. | |
| Modificada | Alta (8.8) | 1.3% | — | Jenkins Jira Issue Updater | 4/4/2019 | 17/6/2026 | Jenkins Jira Issue Updater Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. | |
| Modificada | Media (5.4) | 0.91% | — | Atlassian JiraAtlassian Jira Server | 13/2/2019 | 17/6/2026 | The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the… | |
| Modificada | Media (4.1) | 1.1% | — | Atlassian JiraAtlassian Jira Server | 13/2/2019 | 17/6/2026 | The VerifyPopServerConnection resource in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before… | |
| Modificada | Media (5.4) | 0.94% | — | Atlassian JiraAtlassian Jira Server | 13/2/2019 | 17/6/2026 | The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when… | |
| Modificada | Alta (8.8) | 1.2% | — | Jenkins Jira | 9/1/2019 | 17/6/2026 | An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |
| Modificada | Media (6.1) | 1.4% | — | Atlassian JiraAtlassian Jira Server | 23/10/2018 | 17/6/2026 | Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version 7.12.3, and before… | |
| Modificada | Media (6.1) | 1.4% | — | Atlassian JiraAtlassian Jira Server | 23/10/2018 | 17/6/2026 | The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version… | |
| Modificada | Media (4.7) | 1.4% | — | Atlassian JiraAtlassian Jira Server | 23/10/2018 | 17/6/2026 | Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3, from version 7.11.0 before version 7.11.3, from version 7.12.0 before version… | |
| Modificada | Media (6.1) | 1.0% | — | Atlassian JiraAtlassian Jira Server | 28/8/2018 | 17/6/2026 | Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a… | |
| Modificada | Media (5.3) | 1.8% | — | Atlassian JiraAtlassian Jira Server | 28/8/2018 | 17/6/2026 | The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote attackers who can… | |
| Modificada | Media (5.9) | 1.6% | — | Atlassian JiraAtlassian Jira Server | 24/7/2018 | 17/6/2026 | The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a… | |
| Modificada | Media (6.1) | 1.0% | — | Atlassian JiraAtlassian Jira Server | 18/7/2018 | 17/6/2026 | The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter. | |
| Modificada | Media (6.1) | 1.5% | — | Atlassian JiraAtlassian Jira Server | 16/7/2018 | 17/6/2026 | The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a… |