Yurii Sanin

The issue is related to insufficient access control, which allowed the hijacking of untrusted services.

The issue concerns a stored XSS vulnerability via a project icon.

The issue allows a user with read-only permissions to set a custom logo.

The issue concerns the exposure of an API key with excessive permissions due to the integration with JetBrains Account.

The issue allows an unprivileged user to perform a denial-of-service (DoS) attack.

The issue allows health items of pull requests to be shown to users who lack appropriate permissions.

The issue allows for URL injection leading to CSRF, which could potentially be used for account takeover via CSRF in GitHub authentication.

The issue is related to stored XSS. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

The issue is related to reflected XSS. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows source code to be added to debug logs.

The issue concerns the exposure of an ECR token in a build's parameters.

The issue allows for CSRF via attachment upload.

The issue is related to a Server-Side Request Forgery (SSRF) problem. SSRF is a type of attack where an attacker can trick a server into making requests to internal or external resources that the server should not access.

The issue concerns secure dependency parameters not being masked in depending builds when there are no internal artifacts. This could potentially expose sensitive information.

The issue concerns a Server-Side Request Forgery (SSRF) vulnerability. SSRF is a type of attack where an attacker can trick a server into making requests to internal or external resources, potentially leading to unauthorized access or information disclosure.

The issue is related to a Denial of Service attack via a browser protocol handler.

The issue allows for Server-Side Request Forgery (SSRF) because URL filtering can be escaped.

An attacker can retrieve an issue description without appropriate access.

The issue concerns a Server-Side Request Forgery (SSRF) in the Workflow component.