First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-22370

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	YouTrack	< 2023.3.22666

References

Timeline

Published: Jan 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-223717.5Exposure of sensitive data by by crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent that exposes sensitive data. CVE-2024-223726.8OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exe CVE-2024-223739.8An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3 CVE-2024-223746.5Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially enable denial of servi CVE-2024-223766.7Uncontrolled search path element in some installation software for Intel(R) Ethernet Adapter Driver Pack before version 28.3 may allow an au CVE-2024-223775.3The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.CVE-2024-223786.7Incorrect default permissions in some Intel Unite(R) Client Extended Display Plugin software installers before version 1.1.352.157 may allow CVE-2024-223796.7Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable esc CVE-2024-22385.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions CVE-2024-223805.5Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) Mar CVE-2024-223827.5Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged us CVE-2024-223836.2Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not aut

CVE-2024-22370: Medium severity, CVSS 5.4 | Vulnix