JetBrains YouTrack versions prior to 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.
jetbrains youtrack