Skip to contentJetbrains Youtrack vulnerabilities
- jetbrains youtrackIn JetBrains YouTrack before 2025.2.86935,
2025.2.87167,
2025.3.87341,
2025.3.87344 improper...CVE-2025-545276.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.2.86069,
2024.3.85077,
2025.1.86199 email spoofing via an...CVE-2025-539597.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue...CVE-2025-478504.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing...CVE-2025-483917.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and...CVE-2025-244587.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsCVE-2025-244575.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of...CVE-2024-541583.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp...CVE-2024-541574.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype...CVE-2024-541564.2 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project...CVE-2024-541553.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in...CVE-2024-541548.0 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible...CVE-2024-541533.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML...CVE-2024-505824.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via...CVE-2024-505814.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown...CVE-2024-505804.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was...CVE-2024-505794.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile...CVE-2024-505784.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection...CVE-2024-505774.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestCVE-2024-505764.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APICVE-2024-505754.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header...CVE-2024-505745.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript...CVE-2024-495798.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project...CVE-2024-489025.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageCVE-2024-471624.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate...CVE-2024-471604.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore...CVE-2024-471594.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the...CVE-2024-385066.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-385055.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files...CVE-2024-385044.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper...CVE-2024-352995.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible...CVE-2024-282306.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore...CVE-2024-282296.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in...CVE-2024-282285.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-223704.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread...CVE-2023-508714.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk formsCVE-2023-380686.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleCVE-2023-350544.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk formsCVE-2023-350537.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in...CVE-2022-286507.3 High
- jetbrains youtrackIn JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party...CVE-2022-286494.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedCVE-2022-286485.7 Medium
- jetbrains youtrackJetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection)...CVE-2022-24442Public exploit9.8 Critical
- jetbrains youtrackJetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.CVE-2022-243475.4 Medium
- jetbrains youtrackJetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates...CVE-2022-243445.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only...CVE-2022-243434.3 Medium
- jetbrains youtrack mobileIn JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive...CVE-2021-431875.3 Medium
- jetbrains youtrack mobileIn JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.CVE-2021-431887.3 High
- jetbrains youtrack mobileIn JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.CVE-2021-431897.3 High
- jetbrains youtrack mobileIn JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.CVE-2021-431905.3 Medium
- jetbrains youtrack mobileIn JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.CVE-2021-431925.3 Medium
- Show moreLoading…