Known vulnerabilities in Jira Service Management Server

Vendor: Atlassian
Software CPE: cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:*:*:*:*
Total vulnerabilities: 76
Public exploits: 16
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Jira Service Management Server Jira Service Management Server is affected by 76 known vulnerabilities: 1 critical, 7 high, 58 medium, 10 low Critical High Medium Low

Vulnerabilities (76)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131921 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2026-40175
CWE-113 Medium
No
No
10.3.22, 11.3.7 20.05.2026 SB2026052045
SB2026052051
SB2026052052
and 21 more
#VU131181 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42498
CWE-200 Low
No
No
10.3.22, 11.3.7 12.05.2026 SB2026051281
SB2026051592
SB2026052607
and 18 more
#VU121159 - Resource exhaustion
CVE-2025-15284
CWE-400 Medium
No
No
10.3.16 12.01.2026 SB2026011229
SB2026011326
SB2026011926
and 38 more
#VU120878 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-49735
CWE-22 High
No
No
11.2.1 02.01.2026 SB2023113066
SB2026010213
SB2026010216
#VU116130 - Improper input validation
CVE-2025-9288
CWE-20 Medium
No
No
10.3.16, 11.2.1, 11.3.0 26.09.2025 SB2025092616
SB2025092618
SB2025092620
and 17 more
#VU115762 - Improper input validation
CVE-2025-9287
CWE-20 Medium
No
No
10.3.16, 11.2.1, 11.3.0 18.09.2025 SB2025091827
SB2025091828
SB2025091830
and 12 more
#VU115167 - Allocation of Resources Without Limits or Throttling
CVE-2025-58754
CWE-770 Medium
Available
No
10.3.13, 11.2.1 12.09.2025 SB2025091204
SB2025100104
SB2025100912
and 51 more
#VU114385 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-54988
CWE-611 Medium
Available
No
10.3.15, 11.2.1 22.08.2025 SB2025082219
SB2025083007
SB2025083008
and 31 more
#VU112274 - Improper input validation
CVE-2025-52434
CWE-20 Medium
No
No
5.12.26, 10.3.9 04.07.2025 SB20250704167
SB2025072535
SB2025072536
and 32 more
#VU100921 - Incorrect Regular Expression
CVE-2024-21538
CWE-185 Medium
No
No
10.3.16 26.11.2024 SB2024112627
SB2024112629
SB2024120325
and 67 more
#VU99261 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47875
CWE-79 Medium
No
No
10.3.13 22.10.2024 SB20241022382
SB20241022383
SB20241022392
and 27 more
#VU98132 - Inefficient Regular Expression Complexity
CVE-2024-45296
CWE-1333 Low
No
No
10.3.6 08.10.2024 SB2024100822
SB2024100823
SB2024100826
and 87 more
#VU82314 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')
CVE-2021-39227
CWE-1321 Critical
No
No
10.3.14, 11.3.0 24.10.2023 SB2023102413
SB2025121549
SB2026010215
#VU73969 - Incorrect Regular Expression
CVE-2022-25927
CWE-185 Medium
No
No
10.3.17, 11.3.0 23.03.2023 SB2023032313
SB2023032315
SB2023032710
and 19 more
#VU71109 - Out-of-bounds write
CVE-2022-45693
CWE-787 Medium
No
No
5.12.29 11.01.2023 SB2023011159
SB2023011160
SB2023013112
and 45 more
#VU69942 - Incorrect Regular Expression
CVE-2022-3517
CWE-185 Medium
No
No
10.3.14 06.12.2022 SB2022120638
SB2022120639
SB2022120640
and 48 more
#VU57967 - Improper input validation
CVE-2021-3807
CWE-20 Medium
No
No
10.3.16, 11.2.1 05.11.2021 SB2021110513
SB2021112603
SB2022042257
and 51 more
#VU41989 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-8203
CWE-94 Medium
No
No
10.3.12, 11.1.0 10.08.2020 SB2020071548
SB2020122111
SB2021042308
and 31 more
#VU28582 - Improper input validation
CVE-2016-1181
CWE-20 High
No
No
11.2.1 04.06.2020 SB20200114164
SB20200114165
SB2020071619
and 11 more
#VU2803 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-1182
CWE-79 Low
No
No
11.2.1 30.11.-0001 SB2016040703
SB2023013040
SB2024042318
and 5 more


Showing elements 1 - 20 out of 76