1732 matches found
CVE-2022-25262
CVE-2022-25262 PoC + vulnerability details for CVE-2022-25262 | JetBrains Hub single-click SAML response takeover CVE-2022-25262 Requirements Usage How does it work? Authorization code pool for "OAuth2 - SAML" exchange YouTrack Konnector OAuth2 authorization code takeover by design Mitigation...
CVE-2022-48429_poc
CVE-2022-48429 - XSS Almacenado en YouTrack La descripción reportada del CVE en la base de datos NVD carece de precisión. Esta es una descripción más exacta: Youtrack versión = 2022.3.65373 tiene una vulnerabilidad de Cross-Site Scripting XSS almacenado en los paneles de control. Un usuario...
CVE-2022-24442
CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack By inserting malicious content in the Notification FTL files, an attacker may perform SSTI Server-Side Template Injection attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE...
JetBrains YouTrack < 2026.2.18991 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18991. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification template...
JetBrains YouTrack < 2026.2.19197 Multiple Vulnerabilities
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.19197. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature. CVE-2026-100277 - In JetBrains YouTrack...
CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...
CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs...
CVE-2026-103497
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration...
CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...
CVE-2026-103489
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...
CVE-2026-103493
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103492
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...
CVE-2026-103497
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration...
EUVD-2026-90587
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...
CVE-2026-103496
In JetBrains YouTrack versions prior to 2026.2.19422 , an Insecure Direct Object Reference (iDOR) vulnerability in the inbox threads component allows an attacker to read notifications belonging to other users. The impact of this vulnerability includes unauthorized access to private notifications....