Cross site request forgery (csrf)

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852...

Authorization

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

Code injection

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...

Privilege escalation

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

Design/Logic Flaw

A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168...

CVE-2019-12866

CVE-2019-12866 affects JetBrains YouTrack and is described as an Insecure Direct Object Reference with Authorization Bypass via a user-controlled key. The issue was fixed in YouTrack version 2018.4.49168 (per JetBrains) and is reflected in multiple sources (NVD/Red Hat/CVE listings). The NVD CVSS...

CVE-2019-12866

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

CVE-2019-12867

CVE-2019-12867 affects JetBrains YouTrack. Description across sources states that certain actions could cause privilege escalation for issue attachments, with a fixed build identified as 2018.4.49168. The vulnerability is described consistently in multiple connected documents (Red Hat, NVD, CNVD,...

CVE-2019-12867

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

CVE-2019-12850

The CVE-2019-12850 entry concerns a query injection vulnerability in JetBrains YouTrack. According to multiple sources, including Red Hat and NVD, the issue allowed injection of queries and was fixed in YouTrack version 2018.4.49168. Affected product: YouTrack (JetBrains). Root cause details are ...

CVE-2019-12850

A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168...

CVE-2019-12851

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852...

CVE-2019-12851

CVE-2019-12851 describes a cross-site request forgery (CSRF) vulnerability in an admin endpoint of JetBrains YouTrack. Multiple connected sources corroborate a CSRF issue that could affect YouTrack installations and was remediated by a fix in YouTrack 2018.4.49852. The NVD/NVD-derived metrics ind...

CVE-2019-10100

CVE-2019-10100 affects JetBrains YouTrack Confluence Plugin prior to 1.8.1.3. The vulnerability is Server-Side Template Injection via an Issue macro on a Confluence page, where a crafted link-text-template and valid id field could lead to remote code execution. Public disclosures and multiple ent...

CVE-2019-10100

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins YouTrack plugin (versions 0.7.1 and older) stored credentials unencrypted in the plugin’s global configuration file on the Jenkins master, allowing users with master/file system access to view them. The issue stems from inadequate trust management and plaintext storage in org.jenkinsci.pl...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...