Jetbrains Youtrack vulnerabilities, page 4
180 vulnerabilities
Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2024-54157jetbrainsyoutrack
EPSS score0.60%
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorCVE-2024-54154jetbrainsyoutrackEPSS score0.74%
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxCVE-2024-54153jetbrainsyoutrackEPSS score0.36%
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameterCVE-2024-47162jetbrainsyoutrackEPSS score0.36%
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageCVE-2024-47160jetbrainsyoutrackEPSS score0.37%
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possibleCVE-2024-47159jetbrainsyoutrackEPSS score0.33%
In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a projectCVE-2024-48902jetbrainsyoutrackEPSS score0.38%
In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via APICVE-2024-38506jetbrainsyoutrackEPSS score0.31%
In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsCVE-2024-38504jetbrainsyoutrackEPSS score0.36%
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesCVE-2024-38505jetbrainsyoutrackEPSS score0.44%
In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-22370jetbrainsyoutrackEPSS score0.41%
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-28230jetbrainsyoutrackEPSS score0.52%
In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissionsCVE-2024-28228jetbrainsyoutrackEPSS score0.48%
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleCVE-2024-28229jetbrainsyoutrackEPSS score0.52%
In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articlesCVE-2024-49579jetbrainsyoutrackEPSS score0.45%
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsCVE-2024-50582jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsCVE-2024-50581jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tagCVE-2024-50576jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestCVE-2024-50579jetbrainsyoutrackEPSS score0.32%
In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possibleCVE-2024-50575jetbrainsyoutrackEPSS score0.38%
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API