Exploit for Insufficient Verification of Data Authenticity in Jetbrains Hub

CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-32816)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack 2022.1.43563 previously contained a security vulnerability that could be exploited by attackers to steal a victim's cookie-based authentication credentials...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-32815)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. JetBrains YouTrack 2022.1.43563 previously contained a security vulnerability that could be exploited by attackers to steal a victim's cookie-based authentication credentials...

CVE-2022-28649

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description...

CVE-2022-28649

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28649

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description...

CVE-2022-28648

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered...

CVE-2022-28648

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered...

CVE-2022-28648

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered...

Design/Logic Flaw

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

Code injection

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered...

Design/Logic Flaw

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description...

CVE-2022-28650

JetBrains YouTrack before 2022.1.43700 is affected by a cross-site scripting issue that enables an attacker to inject JavaScript into Markdown in the YouTrack Classic UI. This CVE is corroborated by multiple records (e.g., Red Hat, CNVD, CVE listings) describing the same vulnerability. The availa...

CVE-2022-28650

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI...

CVE-2022-28649

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description...

CVE-2022-28649

Summary: CVE-2022-28649 affects JetBrains YouTrack prior to 2022.1.43563. The issue is an iframe inclusion from a third-party domain in the issue description. What’s affected: YouTrack before version 2022.1.43563. Root cause / vector: Embedding an external iframe in issue descriptions, enabling c...

CVE-2022-28648

Summary: CVE-2022-28648 concerns JetBrains YouTrack prior to version 2022.1.43563, where HTML from the issue description could be rendered in the UI, creating a potential cross-site scripting (XSS) issue. The CNVD entry additionally notes risk of cookie-based credential theft in relation to YouTr...