Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
189 results · page 3 of 4
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possibleCVE-2024-50579 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards pageCVE-2024-50578 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsCVE-2024-50577 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestCVE-2024-50576 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APICVE-2024-50575 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityCVE-2024-50574 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requestsCVE-2024-49579 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.1
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2024In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via APICVE-2024-48902 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageCVE-2024-47162 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.1
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possibleCVE-2024-47160 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a projectCVE-2024-47159 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsCVE-2024-38506 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.3
In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jun 18, 2024In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-38505 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jun 18, 2024In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesCVE-2024-38504 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 16, 2024In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validationCVE-2024-35299 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.9
In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 7, 2024In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissionsCVE-2024-28230 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 7, 2024In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articlesCVE-2024-28229 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Mar 7, 2024In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleCVE-2024-28228 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jan 9, 2024In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-22370 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Dec 15, 2023In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missedCVE-2023-50871 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.3
In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jul 12, 2023In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk formsCVE-2023-38068 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.5
In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jun 12, 2023In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possibleCVE-2023-35054 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jun 12, 2023In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk formsCVE-2023-35053 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 5, 2022In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UICVE-2022-28650 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.3
In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 5, 2022In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue descriptionCVE-2022-28649 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 5, 2022In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being renderedCVE-2022-28648 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.7
In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Feb 25, 2022JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.CVE-2022-24442 · Other software · Jetbrains · reported by MITRECritical 9.8
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comjetbrains.com
Feb 25, 2022JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.CVE-2022-24347 · Other software · Jetbrains · reported by MITREMedium 5.4
JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 25, 2022JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.CVE-2022-24344 · Other software · Jetbrains · reported by MITREMedium 5.4
JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 25, 2022In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.CVE-2022-24343 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.CVE-2021-43192 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.CVE-2021-43191 · Other software · Jetbrains · reported by MITREMedium 5.3
JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.CVE-2021-43190 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.CVE-2021-43189 · Other software · Jetbrains · reported by MITREHigh 7.3
In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.CVE-2021-43188 · Other software · Jetbrains · reported by MITREHigh 7.3
In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.CVE-2021-43187 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
- Product
- Youtrack Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.CVE-2021-43186 · Other software · Jetbrains · reported by MITREMedium 5.4
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.CVE-2021-43185 · Other software · Jetbrains · reported by MITRECritical 9.8
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 9, 2021In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.CVE-2021-43184 · Other software · Jetbrains · reported by MITREMedium 5.4
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.CVE-2021-37554 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.CVE-2021-37553 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.CVE-2021-37552 · Other software · Jetbrains · reported by MITREMedium 5.4
In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.CVE-2021-37551 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.CVE-2021-37550 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 6, 2021In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.CVE-2021-37549 · Other software · Jetbrains · reported by MITRECritical 9.1
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 11, 2021In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.CVE-2021-31905 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 11, 2021In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.CVE-2021-31903 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 11, 2021In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.CVE-2021-31902 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
May 11, 2021In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.CVE-2021-27733 · Other software · Jetbrains · reported by MITREMedium 5.4
In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.CVE-2021-25771 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.