CVEs (116)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue. |
In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators. |
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. |
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. |
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. |
In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. |
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. |
JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere. |
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. |
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. |
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. |
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. |
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. |
A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. |