CVE-2019-12866: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

CVE-2019-12850: Improper Neutralization of Special Elements used in an SQL Command

A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168...

PT-2019-12987

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2018.4.49168 Description A query injection issue was identified, allowing for potential exploitation. The issue was resolved in a later version. Recommendations For versions prior to 2018.4.49168, update to...

PT-2019-12992

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2018.4.49168 Description The issue allows for privilege escalation related to issue attachments. It was resolved in 2018. Recommendations For versions prior to 2018.4.49168, update to version 2018.4.49168 o...

PT-2019-11429

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack Confluence plugin versions prior to 1.8.1.3 Description: The issue allows for Server Side Template Injection. An attacker can add an Issue macro to a page in Confluence and use a combination of a valid id field and speciall...

CVE-2019-12867: Undefined Security Weakness

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168...

CVE-2019-10100: Improper Control of Generation of Code

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to...

CVE-2019-12851: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852...

CVE-2019-12852: Server-Side Request Forgery (SSRF)

An SSRF attack was possible on a JetBrains YouTrack server. The issue 1 of 2 was fixed in JetBrains YouTrack 2018.4.49168...

PT-2019-12989

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2018.4.49168 Description A Server-Side Request Forgery SSRF attack was possible on a JetBrains YouTrack server. Recommendations For versions prior to 2018.4.49168, update to version 2018.4.49168 or later to...

PT-2019-12988

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2018.4.49852 Description A CSRF issue was found in one of the admin endpoints of JetBrains YouTrack. Recommendations For versions prior to 2018.4.49852, update to version 2018.4.49852 or later to resolve th...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

Design/Logic Flaw

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

CVE-2019-10287

Jenkins YouTrack plugin (versions 0.7.1 and older) stored credentials unencrypted in the plugin’s global configuration file on the Jenkins master, allowing users with master/file system access to view them. The issue stems from inadequate trust management and plaintext storage in org.jenkinsci.pl...

CVE-2019-10287: Insufficiently Protected Credentials

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system...

PT-2019-11689 · Jenkins · Youtrack-Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins youtrack-plugin Plugin versions 0.7.1 and older Description: The issue concerns the storage of credentials in the global configuration file on the Jenkins master or controller. Specifically, credentials were stored unencrypted in the...

youtrack-plugin stored credentials in plain text

youtrack-plugin stored credentials unencrypted in its global configuration file org.jenkinsci.plugins.youtrack.YouTrackProjectProperty.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. youtrack-plugin now stores credential...