Jetbrains Youtrack vulnerabilities, page 4
180 vulnerabilities
Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2024-54157jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorEPSS0.60%CriticalCVE-2024-54154jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandboxEPSS0.74%MediumCVE-2024-54153jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameterEPSS0.36%MediumCVE-2024-47162jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageEPSS0.36%MediumCVE-2024-47160jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possibleEPSS0.37%MediumCVE-2024-47159jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a projectEPSS0.33%MediumCVE-2024-48902jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via APIEPSS0.38%HighCVE-2024-38506jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsEPSS0.31%MediumCVE-2024-38504jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesEPSS0.36%HighCVE-2024-38505jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteEPSS0.44%MediumCVE-2024-22370jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleEPSS0.41%MediumCVE-2024-28230jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissionsEPSS0.52%MediumCVE-2024-28228jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleEPSS0.48%MediumCVE-2024-28229jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articlesEPSS0.52%HighCVE-2024-49579jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsEPSS0.45%MediumCVE-2024-50582jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsEPSS0.32%MediumCVE-2024-50581jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tagEPSS0.32%MediumCVE-2024-50576jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestEPSS0.32%MediumCVE-2024-50579jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possibleEPSS0.32%MediumCVE-2024-50575jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APIEPSS0.38%