Jetbrains Youtrack vulnerabilities, page 5

180 vulnerabilities

Known vulnerabilities in Jetbrains Youtrack, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4MediumCVE-2024-50580jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleEPSS0.32%5.4MediumCVE-2024-50577jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsEPSS0.33%5.4MediumCVE-2024-50578jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards pageEPSS0.32%7.5HighCVE-2024-50574jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityEPSS0.63%7.5HighCVE-2024-35299jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validationEPSS0.27%6.1MediumCVE-2019-16171jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.EPSS1.08%6.1MediumCVE-2019-14952jetbrains · youtrackjetbrains youtrackJetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.EPSS1.05%4.3MediumCVE-2019-14956jetbrains · youtrackjetbrains youtrackJetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.EPSS0.98%6.1MediumCVE-2019-14953jetbrains · youtrackjetbrains youtrackJetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.EPSS0.89%5.3MediumCVE-2019-18369jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.EPSS1.15%6.1MediumCVE-2019-15041jetbrains · youtrackjetbrains youtrackJetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.EPSS1.05%8.8HighCVE-2019-15040jetbrains · youtrackjetbrains youtrackJetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.EPSS0.76%9.8CriticalCVE-2019-12850jetbrains · youtrackjetbrains youtrackA query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.EPSS2.08%9.8CriticalCVE-2019-12852jetbrains · youtrackjetbrains youtrackAn SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.EPSS1.84%8.8HighCVE-2019-12851jetbrains · youtrackjetbrains youtrackA CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.EPSS0.75%9.8CriticalCVE-2019-12866jetbrains · youtrackjetbrains youtrackAn Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.EPSS1.94%9.8CriticalCVE-2019-12867jetbrains · youtrackjetbrains youtrackCertain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.EPSS1.99%6.1MediumCVE-2026-61492jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possibleEPSS0.66%3.5LowCVE-2026-59791jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possibleEPSS0.23%9.8CriticalCVE-2026-86478jetbrains · youtrackjetbrains youtrackIn JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email addressEPSS0.61%