Jetbrains Youtrack vulnerabilities, page 3
180 vulnerabilities
Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-27624jetbrainsyoutrack
EPSS score1.38%
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.CVE-2020-24366jetbrainsyoutrackEPSS score0.29%
Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.CVE-2020-24618jetbrainsyoutrackEPSS score1.88%
In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.CVE-2020-15820jetbrainsyoutrackEPSS score1.45%
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.CVE-2020-15819jetbrainsyoutrackEPSS score1.44%
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.CVE-2020-15822jetbrainsyoutrackEPSS score1.42%
In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.CVE-2020-15821jetbrainsyoutrackEPSS score0.93%
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.CVE-2020-15823jetbrainsyoutrackEPSS score1.96%
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.CVE-2020-15818jetbrainsyoutrackEPSS score1.45%
In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.CVE-2020-15817jetbrainsyoutrackEPSS score2.04%
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2022-24344jetbrainsyoutrackEPSS score0.56%
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.CVE-2022-24442jetbrainsyoutrackEPSS score3.75%
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.CVE-2022-24347jetbrainsyoutrackEPSS score0.56%
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.CVE-2022-24343jetbrainsyoutrackEPSS score0.63%
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.CVE-2022-28649jetbrainsyoutrackEPSS score0.40%
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue descriptionCVE-2022-28650jetbrainsyoutrackEPSS score0.63%
In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UICVE-2022-28648jetbrainsyoutrackEPSS score1.39%
In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedCVE-2024-54158jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encodingCVE-2024-54155jetbrainsyoutrackEPSS score0.42%
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authenticationCVE-2024-54156jetbrainsyoutrackEPSS score0.34%
In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack