Jetbrains Youtrack vulnerabilities, page 2
180 vulnerabilities
Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27733jetbrainsyoutrack
EPSS score0.58%
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.CVE-2025-54527jetbrainsyoutrackEPSS score0.29%
In JetBrains YouTrack before 2025.2.86935,
2025.2.87167,
2025.3.87341,
2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictionsCVE-2025-47850jetbrainsyoutrackEPSS score0.38%
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloningCVE-2025-48391jetbrainsyoutrackEPSS score0.43%
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in APICVE-2025-53959jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2025.2.86069,
2024.3.85077,
2025.1.86199 email spoofing via an administrative API was possibleCVE-2025-57731jetbrainsyoutrackEPSS score0.28%
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram contentCVE-2025-24458jetbrainsyoutrackEPSS score0.22%
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationCVE-2025-24457jetbrainsyoutrackEPSS score0.60%
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsCVE-2025-64685jetbrainsyoutrackEPSS score0.24%
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosureCVE-2025-64773jetbrainsyoutrackEPSS score0.23%
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limitCVE-2025-64684jetbrainsyoutrackEPSS score0.34%
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback formCVE-2020-11693jetbrainsyoutrackEPSS score1.78%
JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.CVE-2020-11692jetbrainsyoutrackEPSS score0.92%
In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.CVE-2020-25210jetbrainsyoutrackEPSS score1.45%
In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.CVE-2020-25208jetbrainsyoutrackEPSS score1.35%
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.CVE-2020-25209jetbrainsyoutrackEPSS score2.39%
In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.CVE-2020-7912jetbrainsyoutrackEPSS score1.48%
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.CVE-2020-7913jetbrainsyoutrackEPSS score1.05%
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.CVE-2020-27626jetbrainsyoutrackEPSS score1.31%
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.CVE-2020-27625jetbrainsyoutrackEPSS score1.43%
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.