Youtrack
by Jetbrains
CVEs (114)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-38504 | 0.00 | — | 0.00 | Jun 18, 2024 | In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles | |||
| CVE-2024-35299 | 0.00 | — | 0.00 | May 16, 2024 | In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation | |||
| CVE-2024-28230 | 0.00 | — | 0.01 | Mar 7, 2024 | In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions | |||
| CVE-2024-28229 | 0.00 | — | 0.01 | Mar 7, 2024 | In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles | |||
| CVE-2024-28228 | 0.00 | — | 0.00 | Mar 7, 2024 | In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible | |||
| CVE-2024-22370 | 0.00 | — | 0.00 | Jan 9, 2024 | In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible | |||
| CVE-2023-50871 | 0.00 | — | 0.00 | Dec 15, 2023 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed | |||
| CVE-2023-38068 | 0.00 | — | 0.00 | Jul 12, 2023 | In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms | |||
| CVE-2023-35054 | 0.00 | — | 0.01 | Jun 12, 2023 | In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible | |||
| CVE-2023-35053 | 0.00 | — | 0.01 | Jun 12, 2023 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms | |||
| CVE-2022-28650 | 0.00 | — | 0.01 | Apr 5, 2022 | In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI | |||
| CVE-2022-28649 | 0.00 | — | 0.00 | Apr 5, 2022 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description | |||
| CVE-2022-28648 | 0.00 | — | 0.01 | Apr 5, 2022 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered | |||
| CVE-2022-24442 | 0.00 | — | 0.04 | Feb 25, 2022 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | |||
| CVE-2022-24347 | 0.00 | — | 0.01 | Feb 25, 2022 | JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. | |||
| CVE-2022-24344 | 0.00 | — | 0.01 | Feb 25, 2022 | JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. | |||
| CVE-2022-24343 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. | |||
| CVE-2021-43187 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. | |||
| CVE-2021-43188 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. | |||
| CVE-2021-43189 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. |
- CVE-2024-38504Jun 18, 2024risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
- CVE-2024-35299May 16, 2024risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation
- CVE-2024-28230Mar 7, 2024risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions
- CVE-2024-28229Mar 7, 2024risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
- CVE-2024-28228Mar 7, 2024risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
- CVE-2024-22370Jan 9, 2024risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- CVE-2023-50871Dec 15, 2023risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
- CVE-2023-38068Jul 12, 2023risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
- CVE-2023-35054Jun 12, 2023risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
- CVE-2023-35053Jun 12, 2023risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
- CVE-2022-28650Apr 5, 2022risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
- CVE-2022-28649Apr 5, 2022risk 0.00cvss —epss 0.00
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description
- CVE-2022-28648Apr 5, 2022risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
- CVE-2022-24442Feb 25, 2022risk 0.00cvss —epss 0.04
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- CVE-2022-24347Feb 25, 2022risk 0.00cvss —epss 0.01
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
- CVE-2022-24344Feb 25, 2022risk 0.00cvss —epss 0.01
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
- CVE-2022-24343Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
- CVE-2021-43187Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
- CVE-2021-43188Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
- CVE-2021-43189Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
Page 3 of 6