Peter Af Geijerstam

Name of the Vulnerable Software and Affected Versions: Jira Server and Data Center versions 8.5.11 and earlier Jira Server and Data Center versions 8.6.0 through 8.13.3 Jira Server and Data Center versions 8.14.0 through 8.15.0 Description: The issue navigation and search view in Jira Server and Data Center allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution. This vulnerability enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized access or data theft. Recommendations: For versions 8.5.11 and earlier, update to version 8.5.12 or later. For versions 8.6.0 through 8.13.3, update to version 8.13.4 or later. For versions 8.14.0 through 8.15.0, update to version 8.15.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 **Description** The default webcal: protocol handler in Firefox is vulnerable to cross-site scripting (XSS) attacks, which could allow a remote attacker to impact data integrity. This issue only affects users with an account on the vulnerable service, while other users are unaffected. **Recommendations** For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider disabling the webcal: protocol handler until a patch is available. Restrict access to the vulnerable service to minimize the risk of exploitation.