In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.
JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.
In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without appropriate access.