871 matches found
CVE-2022-24442
CVE-2022-24442: JetBrains YouTrack의 FreeMarker 서버 측 템플릿 주입 Notification FTL 파일에 악성 콘텐츠를 삽입함으로써, 공격자는 SSTI서버 측 템플릿 주입 공격을 수행할 수 있으며, 이를 통해 FreeMarker 노출 객체를 활용해 제한을 우회하고 RCE원격 코드 실행를 얻을 수 있습니다. 참고: 이 문제는 CVE-2021-25770에 대한 불완전한 수정으로 인해 존재합니다. 벤더 공개: 이 취약점에 대한 벤더의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. 요구 사항...
JetBrains YouTrack < 2026.1.13901 / 2026.2.x < 2026.2.17950 DoS (CVE-2026-75050)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13901, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via crafted type parameters. CVE-2026-75050 Note that Nessus has not tested for...
JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...
JetBrains YouTrack < 2025.3.156085 / 2026.1.x < 2026.1.13913 / 2026.2.x < 2026.2.18112 Authentication Bypass (CVE-2026-75045)
The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.156085, 2026.1.x prior to 2026.1.13913, or 2026.2.x prior to 2026.2.18112. It is, therefore, affected by an authentication bypass vulnerability: - An unauthenticated attacker could download database backups via shar...
JetBrains YouTrack < 2026.2.18177 DoS (CVE-2026-75047)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18177. It is, therefore, affected by a denial of service vulnerability: - A DoS attack was possible via a decompression bomb in the import endpoint. CVE-2026-75047 Note that Nessus has not tested for this issue but...
JetBrains YouTrack < 2026.2.17917 Missing Authorization (CVE-2026-75051)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.17917. It is, therefore, affected by a missing authorization vulnerability: - Unauthorised project transfer between organisations was possible. CVE-2026-75051 Note that Nessus has not tested for this issue but has...
JetBrains YouTrack < 2026.1.13903 / 2026.2.x < 2026.2.17950 Information Disclosure (CVE-2026-75049)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13903, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could read restricted articles from other projects via the draft creation...
JetBrains YouTrack < 2026.2.18112 Information Disclosure (CVE-2026-75046)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18112. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could enumerate accounts via the users search endpoint. CVE-2026-75046 Note that Nessus has not tested for this...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75050
In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
CVE-2026-75045
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...
CVE-2026-75046
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
EUVD-2026-60250
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
CVE-2026-75051
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...
EUVD-2026-60247
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...
CVE-2026-75049
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...
CVE-2026-75049
JetBrains YouTrack (versions before 2026.1.13903 and 2026.2.17950) has an authorization flaw: an authenticated user with low privileges can use the draft creation endpoint to read restricted articles from other projects, causing high confidentiality impact (CVSS 6.5). No in-the-wlood exploitation...