JetBrains YouTrack

• CVE-2024-50580 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule 0.3%
• CVE-2024-50579 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible 0.3%
• CVE-2024-50578 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page 0.3%
• CVE-2024-50577 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings 0.3%
• CVE-2024-50576 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest 0.3%
• CVE-2024-50575 Medium 4.6 In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API 0.4%
• CVE-2024-50574 Medium 5.3 In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality 0.6%
• CVE-2024-49579 High 8.1 In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests 0.4%
• CVE-2024-48902 Medium 5.4 In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API 0.4%
• CVE-2024-47162 Medium 4.1 In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page 0.4%
• CVE-2024-47160 Medium 4.3 In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible 0.4%
• CVE-2024-47159 Medium 4.3 In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project 0.3%
• CVE-2024-38506 Medium 6.3 In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows 0.3%
• CVE-2024-38505 Medium 5.3 In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site 0.4%
• CVE-2024-38504 Medium 4.3 In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles 0.4%
• CVE-2024-35299 Medium 5.9 In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation 0.3%
• CVE-2024-28230 Medium 6.5 In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions 0.5%
• CVE-2024-28229 Medium 6.5 In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles 0.5%
• CVE-2024-28228 Medium 5.3 In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible 0.5%
• CVE-2024-22370 Medium 4.6 In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible 0.4%
• CVE-2023-50871 Medium 4.3 In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed 0.4%
• CVE-2023-38068 Medium 6.5 In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms 0.5%
• CVE-2023-35054 Medium 4.6 In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible 1.0%
• CVE-2023-35053 High 7.5 In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms 0.6%
• CVE-2022-28650 High 7.3 In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI 0.6%
• CVE-2022-28649 Medium 4.6 In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description 0.4%
• CVE-2022-28648 Medium 5.7 In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered 1.4%