In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
NVD-CWE-noinfo