Vulnerabilities

TI-2024-34011 CVE-2024-50582 · GHSA-65xw-vg7q-v4cg

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements

LOW 24

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34010 CVE-2024-50581 · GHSA-q2mc-p2rh-669x

LOW 24

In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34009 CVE-2024-50580 · GHSA-q5cj-8jcp-gxw4

LOW 24

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34008 CVE-2024-50579 · GHSA-vh8w-p5mj-44gq

LOW 27

In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00321 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34007 CVE-2024-50578 · GHSA-84f5-47c9-mwpg

LOW 24

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34006 CVE-2024-50577 · GHSA-88gm-grvr-fqwf

LOW 24

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00325 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34005 CVE-2024-50576 · GHSA-3g37-ghfj-6c5g

LOW 24

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00318 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34004 CVE-2024-50575 · GHSA-c3c4-x529-6x9q

LOW 27

In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00381 Published 2024-10-28 Fixed in 2024.3.47707 CWE-79

TI-2024-34003 CVE-2024-50574 · GHSA-4pm8-rxv6-frfv

LOW 34

In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00631 Published 2024-10-28 Fixed in 2024.3.47707 CWE-1333