VendorsJetBrainsyoutrackall versions

Vulnerabilities

JetBrains YouTrack

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

125CVEs

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

Published 2024-01-09 · Modified

5.4EPSS 0.004

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description

Published 2022-04-05 · Modified

5.4EPSS 0.004

In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API

Published 2024-10-10 · Analyzed

5.4EPSS 0.004

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements

Published 2024-10-28 · Analyzed

5.4EPSS 0.003

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.

Published 2021-02-03 · Modified

5.3EPSS 0.026

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.

Published 2020-01-30 · Modified

5.3EPSS 0.015

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

Published 2020-08-08 · Modified

5.3EPSS 0.014

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.

Published 2020-08-08 · Modified

5.3EPSS 0.014

In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.

Published 2020-11-16 · Modified

5.3EPSS 0.014

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

Published 2020-08-08 · Modified

5.3EPSS 0.014

In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.

Published 2020-11-16 · Modified

5.3EPSS 0.014

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

Published 2021-02-03 · Modified

5.3EPSS 0.014

JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.

Published 2020-11-16 · Modified

5.3EPSS 0.014

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

Published 2021-02-03 · Modified

5.3EPSS 0.014

JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.

Published 2020-11-16 · Modified

5.3EPSS 0.013

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

Published 2021-02-03 · Modified

5.3EPSS 0.012

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

Published 2019-10-31 · Modified

5.3EPSS 0.011

In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.

Published 2021-08-06 · Modified

5.3EPSS 0.007

In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible

Published 2024-03-07 · Analyzed

5.3EPSS 0.005

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

Published 2024-12-04 · Analyzed

5.3EPSS 0.004

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible

Published 2024-09-19 · Analyzed

5.3EPSS 0.004

In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning

Published 2025-05-20 · Analyzed

5.3EPSS 0.004

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles

Published 2024-06-18 · Modified

5.3EPSS 0.004

In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page

Published 2024-09-19 · Analyzed

5.3EPSS 0.004

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

Published 2024-12-04 · Analyzed

5.3EPSS 0.003

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

Published 2026-06-26 · Analyzed

5.3EPSS 0.003

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

Published 2026-06-26 · Analyzed

5.3EPSS 0.003

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

Published 2026-06-26 · Analyzed

5.3EPSS 0.002

In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.

Published 2021-02-03 · Modified

5.0EPSS 0.015

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.

Published 2019-10-02 · Modified

4.3EPSS 0.010

In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.

Published 2021-08-06 · Modified

4.3EPSS 0.009

In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.

Published 2022-02-25 · Modified

4.3EPSS 0.006

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed

Published 2023-12-15 · Modified

4.3EPSS 0.004

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project

Published 2024-09-19 · Analyzed

4.3EPSS 0.003

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

Published 2026-05-29 · Analyzed

4.3EPSS 0.003