81 results · Clear filters · Feed
-
Medium 4.7
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server conf…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other pro…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue vis…
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
-
Medium 6.4
In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to …
-
Medium 5.5
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
-
Medium 5.4
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
-
Medium 6.6
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
-
Medium 6.9
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run t…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
-
Medium 4.9
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Ad…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
-
Medium 4.7
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only …
-
Medium 5.3
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
-
Medium 5.5
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant t…
-
Medium 4.3
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of vi…
-
Medium 6.8
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administr…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inacces…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter emai…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify white…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app im…
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders …
-
Medium 6.5
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved s…
-
Medium 4.6
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint