Jetbrains Upsource — known CVE vulnerabilities

Every CVE whose affected-product data names Jetbrains Upsource, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (5)

• CVE-2019-12157 — CVSS 9.8 (critical): In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
• CVE-2019-19704 — CVSS 7.5 (high): In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.
• CVE-2021-30482 — CVSS 7.5 (high): In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
• CVE-2019-14961 — CVSS 6.1 (medium): JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.
• CVE-2019-12156 — CVSS 5.3 (medium): Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity…