Jetbrains
Page 3 of 7 — Jetbrains CVEs from a corpus of 602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41827 | High | 7.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration |
CVE-2024-41826 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page |
CVE-2024-41825 | Medium | 4.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab |
CVE-2024-41824 | Medium | 6.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases |
CVE-2024-39879 | Medium | 5.0 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings |
CVE-2024-39878 | Medium | 4.1 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection |
CVE-2024-38507 | Low | 3.5 | 2024-06-18 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible |
CVE-2024-38506 | Medium | 6.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows |
CVE-2024-38505 | Medium | 5.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site |
CVE-2024-38504 | Medium | 4.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2024-36470 | High | 8.1 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases |
CVE-2024-36378 | Medium | 5.9 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens |
CVE-2024-36377 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions |
CVE-2024-36376 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions |
CVE-2024-36375 | Medium | 5.3 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed |
CVE-2024-36374 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible |
CVE-2024-36373 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible |
CVE-2024-36372 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible |
CVE-2024-36371 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible |
CVE-2024-36370 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible |
CVE-2024-36369 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible |
CVE-2024-36368 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible |
CVE-2024-36367 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible |
CVE-2024-36366 | Medium | 5.4 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations |
CVE-2024-36365 | Medium | 6.8 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent |
CVE-2024-36364 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was… |
CVE-2024-36363 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-35302 | Medium | 5.4 | 2024-05-16 | In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible |
CVE-2024-35301 | Medium | 5.5 | 2024-05-16 | In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token |
CVE-2024-35300 | Low | 3.5 | 2024-05-16 | In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible |
CVE-2024-35299 | Medium | 5.9 | 2024-05-16 | In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation |
CVE-2024-31140 | Medium | 4.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools |
CVE-2024-31139 | Medium | 5.9 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector |
CVE-2024-31138 | Medium | 4.6 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
CVE-2024-31137 | Medium | 6.8 | 2024-03-28 | In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration |
CVE-2024-31136 | High | 7.4 | 2024-03-28 | In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter |
CVE-2024-31135 | Medium | 6.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 open redirect was possible on the login page |
CVE-2024-31134 | Medium | 6.5 | 2024-03-28 | In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled |
CVE-2024-29880 | Medium | 4.2 | 2024-03-21 | In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process |
CVE-2024-28230 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions |
CVE-2024-28229 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles |
CVE-2024-28228 | Medium | 5.3 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible |
CVE-2024-28174 | Medium | 5.8 | 2024-03-06 | In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly |
CVE-2024-28173 | Medium | 4.3 | 2024-03-06 | In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-24943 | Medium | 5.3 | 2024-02-06 | In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24941 | Medium | 6.1 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24939 | Low | 3.3 | 2024-02-06 | In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible |
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2024-24937 | Medium | 4.6 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2024-22370 | Medium | 4.6 | 2024-01-09 | In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible |
CVE-2023-51655 | Medium | 6.3 | 2023-12-21 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project con… |
CVE-2023-50871 | Medium | 4.3 | 2023-12-15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed |
CVE-2023-50870 | Medium | 4.3 | 2023-12-15 | In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible |
CVE-2023-45613 | Medium | 6.8 | 2023-10-09 | In JetBrains Ktor before 2.3.5 server certificates were not verified |
CVE-2023-45612 | High | 8.6 | 2023-10-09 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE |
CVE-2023-43566 | Low | 3.5 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-41250 | Low | 3.5 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration |
CVE-2023-41249 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step |
CVE-2023-41248 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration |
CVE-2023-39261 | Medium | 5.2 | 2023-07-26 | In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions |
CVE-2023-39175 | Medium | 4.6 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible |
CVE-2023-39174 | Medium | 4.3 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers |
CVE-2023-39173 | Medium | 5.4 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access |
CVE-2023-38069 | Low | 3.3 | 2023-07-12 | In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases |
CVE-2023-38068 | Medium | 6.5 | 2023-07-12 | In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms |
CVE-2023-38067 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log |
CVE-2023-38066 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads |
CVE-2023-38065 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible |
CVE-2023-38064 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log |
CVE-2023-38063 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible |
CVE-2023-38062 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations |
CVE-2023-38061 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible |
CVE-2015-1313 | Medium | 6.5 | 2023-06-29 | JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced b… |
CVE-2023-35054 | Medium | 4.6 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible |
CVE-2023-35053 | High | 7.5 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms |
CVE-2023-34339 | Low | 3.3 | 2023-06-01 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message |
CVE-2023-34229 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible |
CVE-2023-34228 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions |
CVE-2023-34227 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks |
CVE-2023-34226 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible |
CVE-2023-34225 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible |
CVE-2023-34224 | Medium | 4.8 | 2023-05-31 | In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible |
CVE-2023-34223 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases |
CVE-2023-34222 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible |
CVE-2023-34221 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible |
CVE-2023-34220 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |
CVE-2022-48481 | Medium | 5.2 | 2023-04-28 | In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible |
CVE-2022-48477 | Medium | 4.1 | 2023-04-24 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing |
CVE-2022-48476 | High | 7.5 | 2023-04-24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible |