CVE-2022-25259

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

CVE-2022-24328

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.

CVE-2022-29811

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

CVE-2021-37541

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

CVE-2021-25757

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

CVE-2021-25759

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

CVE-2021-43181

In JetBrains Hub before 2021.1.13690, stored XSS is possible.