Youtrack
by Jetbrains
CVEs (114)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-7913 | 0.00 | — | 0.01 | Jan 30, 2020 | JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. | |||
| CVE-2020-7912 | 0.00 | — | 0.01 | Jan 30, 2020 | In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. | |||
| CVE-2019-18369 | 0.00 | — | 0.01 | Oct 31, 2019 | In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. | |||
| CVE-2019-14956 | 0.00 | — | 0.01 | Oct 2, 2019 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. | |||
| CVE-2019-15040 | 0.00 | — | 0.01 | Oct 2, 2019 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. | |||
| CVE-2019-16171 | 0.00 | — | 0.01 | Oct 2, 2019 | In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. | |||
| CVE-2019-15041 | 0.00 | — | 0.01 | Oct 1, 2019 | JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere. | |||
| CVE-2019-14953 | 0.00 | — | 0.01 | Oct 1, 2019 | JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. | |||
| CVE-2019-14952 | 0.00 | — | 0.01 | Oct 1, 2019 | JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. | |||
| CVE-2019-12852 | 0.00 | — | 0.02 | Jul 3, 2019 | An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. | |||
| CVE-2019-12866 | 0.00 | — | 0.02 | Jul 3, 2019 | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||
| CVE-2019-12867 | 0.00 | — | 0.02 | Jul 3, 2019 | Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||
| CVE-2019-12850 | 0.00 | — | 0.02 | Jul 3, 2019 | A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. | |||
| CVE-2019-12851 | 0.00 | — | 0.01 | Jul 3, 2019 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |
- CVE-2020-7913Jan 30, 2020risk 0.00cvss —epss 0.01
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
- CVE-2020-7912Jan 30, 2020risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
- CVE-2019-18369Oct 31, 2019risk 0.00cvss —epss 0.01
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
- CVE-2019-14956Oct 2, 2019risk 0.00cvss —epss 0.01
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
- CVE-2019-15040Oct 2, 2019risk 0.00cvss —epss 0.01
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
- CVE-2019-16171Oct 2, 2019risk 0.00cvss —epss 0.01
In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.
- CVE-2019-15041Oct 1, 2019risk 0.00cvss —epss 0.01
JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.
- CVE-2019-14953Oct 1, 2019risk 0.00cvss —epss 0.01
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
- CVE-2019-14952Oct 1, 2019risk 0.00cvss —epss 0.01
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
- CVE-2019-12852Jul 3, 2019risk 0.00cvss —epss 0.02
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
- CVE-2019-12866Jul 3, 2019risk 0.00cvss —epss 0.02
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- CVE-2019-12867Jul 3, 2019risk 0.00cvss —epss 0.02
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- CVE-2019-12850Jul 3, 2019risk 0.00cvss —epss 0.02
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
- CVE-2019-12851Jul 3, 2019risk 0.00cvss —epss 0.01
A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
Page 6 of 6