https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-16909.htmlhttps://patchthecve.com/cve/CVE-2019-16909.htmlWed, 17 Jun 2026 02:22:56 +0000MEDIUM 4.3: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects (with authentication as a Jira user, but without authorization for specific projects) via the plugins/servlet/nfj/NotificationSettings URI.https://patchthecve.com/cve/CVE-2019-16908.htmlhttps://patchthecve.com/cve/CVE-2019-16908.htmlWed, 17 Jun 2026 02:22:56 +0000MEDIUM 5.3: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app before 1.6.14_J8 for Jira. It is possible to obtain a list of all Jira projects without authentication/authorization via the plugins/servlet/nfj/ProjectFilter?searchQuery= URI.https://patchthecve.com/cve/CVE-2019-16907.htmlhttps://patchthecve.com/cve/CVE-2019-16907.htmlWed, 17 Jun 2026 02:22:56 +0000MEDIUM 5.3: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI.https://patchthecve.com/cve/CVE-2019-16906.htmlhttps://patchthecve.com/cve/CVE-2019-16906.htmlWed, 17 Jun 2026 02:22:56 +0000HIGH 7.5: An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13_J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no longe