Jetbrains
Page 2 of 7 — Jetbrains CVEs from a corpus of 602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-57732 | High | 7.5 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership |
CVE-2025-57731 | High | 8.7 | 2025-08-20 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
CVE-2025-57730 | Medium | 5.2 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature |
CVE-2025-57729 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start |
CVE-2025-57728 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |
CVE-2025-57727 | Medium | 4.7 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference |
CVE-2025-54538 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
CVE-2025-54537 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
CVE-2025-54536 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint |
CVE-2025-54535 | Medium | 5.8 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms |
CVE-2025-54534 | Medium | 4.8 | 2025-07-28 | In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page |
CVE-2025-54533 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration |
CVE-2025-54532 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies |
CVE-2025-54531 | High | 7.7 | 2025-07-28 | In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows |
CVE-2025-54530 | High | 7.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions |
CVE-2025-54529 | Low | 3.7 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration |
CVE-2025-54528 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow |
CVE-2025-54527 | Medium | 6.1 | 2025-07-28 | In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass… |
CVE-2025-53959 | High | 7.6 | 2025-07-15 | In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible |
CVE-2025-52879 | Medium | 4.8 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible |
CVE-2025-52878 | Medium | 4.3 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions |
CVE-2025-52877 | Medium | 4.8 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible |
CVE-2025-52876 | Medium | 5.4 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible |
CVE-2025-52875 | Medium | 5.4 | 2025-06-23 | In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible |
CVE-2025-48391 | High | 7.7 | 2025-05-20 | In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |
CVE-2025-47854 | Medium | 4.3 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page |
CVE-2025-47853 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible |
CVE-2025-47852 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible |
CVE-2025-47851 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible |
CVE-2025-47850 | Medium | 4.3 | 2025-05-20 | In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning |
CVE-2025-46618 | Low | 3.5 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
CVE-2025-46433 | Medium | 4.9 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
CVE-2025-46432 | Medium | 4.3 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
CVE-2025-43016 | Medium | 5.4 | 2025-04-25 | In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session |
CVE-2025-43015 | High | 8.3 | 2025-04-17 | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
CVE-2025-43014 | Medium | 6.1 | 2025-04-17 | In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation |
CVE-2025-43013 | Medium | 6.9 | 2025-04-17 | In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible |
CVE-2025-43012 | High | 8.3 | 2025-04-17 | In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
CVE-2025-42921 | Medium | 4.2 | 2025-04-17 | In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin |
CVE-2025-32054 | Low | 3.3 | 2025-04-03 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
CVE-2025-31141 | Low | 2.7 | 2025-03-27 | In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
CVE-2025-31140 | Medium | 4.6 | 2025-03-27 | In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page |
CVE-2025-31139 | Medium | 4.3 | 2025-03-27 | In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log |
CVE-2025-29932 | Medium | 4.1 | 2025-03-25 | In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
CVE-2025-29904 | Medium | 5.3 | 2025-03-12 | In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible |
CVE-2025-29903 | Medium | 5.2 | 2025-03-12 | In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible |
CVE-2025-26493 | Medium | 4.6 | 2025-02-11 | In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab |
CVE-2025-26492 | High | 7.7 | 2025-02-11 | In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources |
CVE-2025-23385 | High | 7.8 | 2025-01-28 | In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7… |
CVE-2025-24461 | Medium | 6.5 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint |
CVE-2025-24460 | Medium | 4.3 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool |
CVE-2025-24459 | Medium | 4.6 | 2025-01-21 | In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page |
CVE-2025-24458 | High | 7.1 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration |
CVE-2025-24457 | Medium | 5.5 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs |
CVE-2025-24456 | Medium | 6.7 | 2025-01-21 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-56355 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS |
CVE-2024-56354 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |
CVE-2024-56353 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies |
CVE-2024-56352 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page |
CVE-2024-56351 | Medium | 6.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56349 | Medium | 5.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-54158 | Low | 3.5 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding |
CVE-2024-54157 | Medium | 4.3 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector |
CVE-2024-54156 | Medium | 4.2 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-52555 | Medium | 6.3 | 2024-11-15 | In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script |
CVE-2024-50582 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements |
CVE-2024-50581 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag |
CVE-2024-50580 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule |
CVE-2024-50579 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible |
CVE-2024-50578 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page |
CVE-2024-50577 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings |
CVE-2024-50576 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest |
CVE-2024-50575 | Medium | 5.4 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API |
CVE-2024-50574 | Medium | 5.3 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality |
CVE-2024-50573 | Medium | 4.3 | 2024-10-28 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services |
CVE-2024-49580 | Medium | 5.3 | 2024-10-17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure |
CVE-2024-49579 | High | 8.1 | 2024-10-17 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests |
CVE-2024-48902 | Medium | 5.4 | 2024-10-10 | In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API |
CVE-2024-47951 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings |
CVE-2024-47950 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47161 | Medium | 4.3 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API |
CVE-2024-47162 | Medium | 4.1 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page |
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-46970 | Low | 3.3 | 2024-09-16 | In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible |
CVE-2024-43810 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin |
CVE-2024-43809 | Low | 3.5 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page |
CVE-2024-43808 | Low | 3.7 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin |
CVE-2024-43807 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page |
CVE-2024-43114 | High | 7.5 | 2024-08-06 | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-41828 | Low | 2.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time |