CVE-2010-1165

Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka attachments), (2) index (aka indexing), or (3) backup path and then uploading a file, as exploited in the wild in April 2010.

• CWE-94

• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16Patch, Vendor Advisory
• http://jira.atlassian.com/browse/JRA-20995Vendor Advisory
• http://jira.atlassian.com/browse/JRA-21004Patch, Vendor Advisory
• http://secunia.com/advisories/39353Vendor Advisory
• http://www.openwall.com/lists/oss-security/2010/04/16/3
• http://www.openwall.com/lists/oss-security/2010/04/16/4
• http://www.securityfocus.com/bid/39485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57828
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16Patch, Vendor Advisory
• http://jira.atlassian.com/browse/JRA-20995Vendor Advisory
• http://jira.atlassian.com/browse/JRA-21004Patch, Vendor Advisory
• http://secunia.com/advisories/39353Vendor Advisory
• http://www.openwall.com/lists/oss-security/2010/04/16/3
• http://www.openwall.com/lists/oss-security/2010/04/16/4
• http://www.securityfocus.com/bid/39485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/57828

Published

Apr 20, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-1159Multiple heap-based buffer overflows in Aircrack-ng before 1…
• CVE-2010-1160GNU nano before 2.2.4 does not verify whether a file has bee…
• CVE-2010-1161Race condition in GNU nano before 2.2.4, when run by root to…
• CVE-2010-1162The release_one_tty function in drivers/char/tty_io.c in the…
• CVE-2010-1163The command matching functionality in sudo 1.6.8 through 1.7…
• CVE-2010-1164Multiple cross-site scripting (XSS) vulnerabilities in Atlas…
• CVE-2010-1166The fbComposite function in fbpict.c in the Render extension…
• CVE-2010-1167fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, …
• CVE-2010-1168The Safe (aka Safe.pm) module before 2.25 for Perl allows co…
• CVE-2010-1169PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before …
• CVE-2010-1170The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8…
• CVE-2010-1171Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a danger…