Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
189 results · page 4 of 4
Feb 3, 2021In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.CVE-2021-25770 · Other software · Jetbrains · reported by MITRECritical 9.8
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.CVE-2021-25769 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.CVE-2021-25768 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.CVE-2021-25767 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.CVE-2021-25766 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.CVE-2021-25765 · Other software · Jetbrains · reported by MITREHigh 8.8
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Feb 3, 2021In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.CVE-2020-25208 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.CVE-2020-27626 · Other software · Jetbrains · reported by MITREMedium 5.3
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.CVE-2020-27625 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.CVE-2020-27624 · Other software · Jetbrains · reported by MITREMedium 5.3
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.CVE-2020-25210 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.CVE-2020-25209 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Nov 16, 2020Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.CVE-2020-24366 · Other software · Jetbrains · reported by MITRELow 3.3
Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 19, 2020In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.CVE-2020-15822 · Other software · Jetbrains · reported by MITREHigh 7.3
In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 27, 2020In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue dCVE-2020-24618 · Other software · Jetbrains · reported by MITREMedium 6.5
In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.CVE-2020-15823 · Other software · Jetbrains · reported by MITREHigh 7.5
JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.CVE-2020-15821 · Other software · Jetbrains · reported by MITREMedium 6.5
In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.CVE-2020-15820 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.CVE-2020-15819 · Other software · Jetbrains · reported by MITREMedium 5.3
JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.CVE-2020-15818 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2020-15817 · Other software · Jetbrains · reported by MITREHigh 8.8
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.CVE-2020-11693 · Other software · Jetbrains · reported by MITREHigh 7.5
JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.CVE-2020-11692 · Other software · Jetbrains · reported by MITRELow 2.7
In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.CVE-2020-7913 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.CVE-2020-7912 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.CVE-2019-18369 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.CVE-2019-16171 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.CVE-2019-15040 · Other software · Jetbrains · reported by MITREHigh 8.8
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.CVE-2019-14956 · Other software · Jetbrains · reported by MITREMedium 4.3
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.CVE-2019-15041 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.CVE-2019-14953 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.CVE-2019-14952 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019An SSRF attack was possible on a JetBrains YouTrack server.CVE-2019-12852 · Other software · Jetbrains · reported by MITRECritical 9.8
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack.CVE-2019-12867 · Other software · Jetbrains · reported by MITRECritical 9.8
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack.CVE-2019-12866 · Other software · Jetbrains · reported by MITRECritical 9.8
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack.CVE-2019-12851 · Other software · Jetbrains · reported by MITREHigh 8.8
A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019A query injection was possible in JetBrains YouTrack.CVE-2019-12850 · Other software · Jetbrains · reported by MITRECritical 9.8
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
- Product
- Youtrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection.CVE-2019-10100 · Other software · Jetbrains · reported by MITRECritical 9.8
In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely.
- Product
- Youtrack Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 4, 2019Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed CVE-2019-10287 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
- Product
- Jenkins youtrack-plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.