youtrack

CVE-2021-37549

February 23, 2023 by

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.

February 23, 2023 by

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

February 23, 2023 by godfreyd94

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI

February 23, 2023 by godfreyd94

In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description

February 23, 2023 by godfreyd94

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered

February 23, 2023 by godfreyd94

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.