Jetbrains
Page 3 of 7 — Jetbrains CVEs from a corpus of 649, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24457 | Medium | 5.5 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs |
CVE-2025-24456 | Medium | 6.7 | 2025-01-21 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-56355 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS |
CVE-2024-56354 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |
CVE-2024-56353 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies |
CVE-2024-56352 | Medium | 4.6 | 2024-12-20 | In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page |
CVE-2024-56351 | Medium | 6.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles |
CVE-2024-56350 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects |
CVE-2024-56349 | Medium | 5.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs |
CVE-2024-56348 | Medium | 4.3 | 2024-12-20 | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents |
CVE-2024-54158 | Low | 3.5 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding |
CVE-2024-54157 | Medium | 4.3 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector |
CVE-2024-54156 | Medium | 4.2 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack |
CVE-2024-54155 | Low | 3.7 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2024-54153 | Low | 3.1 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter |
CVE-2024-52555 | Medium | 6.3 | 2024-11-15 | In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script |
CVE-2024-50582 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements |
CVE-2024-50581 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag |
CVE-2024-50580 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule |
CVE-2024-50579 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible |
CVE-2024-50578 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page |
CVE-2024-50577 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings |
CVE-2024-50576 | Medium | 4.6 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest |
CVE-2024-50575 | Medium | 5.4 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API |
CVE-2024-50574 | Medium | 5.3 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality |
CVE-2024-50573 | Medium | 4.3 | 2024-10-28 | In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services |
CVE-2024-49580 | Medium | 5.3 | 2024-10-17 | In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure |
CVE-2024-49579 | High | 8.1 | 2024-10-17 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests |
CVE-2024-48902 | Medium | 5.4 | 2024-10-10 | In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via API |
CVE-2024-47951 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings |
CVE-2024-47950 | Low | 3.5 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings |
CVE-2024-47949 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location |
CVE-2024-47948 | Medium | 4.9 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups |
CVE-2024-47161 | Medium | 4.3 | 2024-10-08 | In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API |
CVE-2024-47162 | Medium | 4.1 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page |
CVE-2024-47160 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible |
CVE-2024-47159 | Medium | 4.3 | 2024-09-19 | In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project |
CVE-2024-46970 | Low | 3.3 | 2024-09-16 | In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible |
CVE-2024-43810 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin |
CVE-2024-43809 | Low | 3.5 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page |
CVE-2024-43808 | Low | 3.7 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin |
CVE-2024-43807 | Medium | 4.6 | 2024-08-16 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page |
CVE-2024-43114 | High | 7.5 | 2024-08-06 | In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions |
CVE-2024-41829 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection |
CVE-2024-41828 | Low | 2.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time |
CVE-2024-41827 | High | 7.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration |
CVE-2024-41826 | Low | 3.5 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page |
CVE-2024-41825 | Medium | 4.6 | 2024-07-22 | In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab |
CVE-2024-41824 | Medium | 6.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases |
CVE-2024-39879 | Medium | 5.0 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings |
CVE-2024-39878 | Medium | 4.1 | 2024-07-01 | In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection |
CVE-2024-38507 | Low | 3.5 | 2024-06-18 | In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible |
CVE-2024-38506 | Medium | 6.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows |
CVE-2024-38505 | Medium | 5.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site |
CVE-2024-38504 | Medium | 4.3 | 2024-06-18 | In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2024-36470 | High | 8.1 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases |
CVE-2024-36378 | Medium | 5.9 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens |
CVE-2024-36377 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions |
CVE-2024-36376 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions |
CVE-2024-36375 | Medium | 5.3 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed |
CVE-2024-36374 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible |
CVE-2024-36373 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible |
CVE-2024-36372 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible |
CVE-2024-36371 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible |
CVE-2024-36370 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible |
CVE-2024-36369 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible |
CVE-2024-36368 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible |
CVE-2024-36367 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible |
CVE-2024-36366 | Medium | 5.4 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations |
CVE-2024-36365 | Medium | 6.8 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent |
CVE-2024-36364 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was… |
CVE-2024-36363 | Medium | 4.6 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible |
CVE-2024-36362 | Medium | 6.5 | 2024-05-29 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible |
CVE-2024-35302 | Medium | 5.4 | 2024-05-16 | In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible |
CVE-2024-35301 | Medium | 5.5 | 2024-05-16 | In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token |
CVE-2024-35300 | Low | 3.5 | 2024-05-16 | In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible |
CVE-2024-35299 | Medium | 5.9 | 2024-05-16 | In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation |
CVE-2024-31140 | Medium | 4.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools |
CVE-2024-31139 | Medium | 5.9 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector |
CVE-2024-31138 | Medium | 4.6 | 2024-03-28 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
CVE-2024-31137 | Medium | 6.8 | 2024-03-28 | In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration |
CVE-2024-31136 | High | 7.4 | 2024-03-28 | In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter |
CVE-2024-31135 | Medium | 6.1 | 2024-03-28 | In JetBrains TeamCity before 2024.03 open redirect was possible on the login page |
CVE-2024-31134 | Medium | 6.5 | 2024-03-28 | In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled |
CVE-2024-29880 | Medium | 4.2 | 2024-03-21 | In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process |
CVE-2024-28230 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions |
CVE-2024-28229 | Medium | 6.5 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles |
CVE-2024-28228 | Medium | 5.3 | 2024-03-07 | In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible |
CVE-2024-28174 | Medium | 5.8 | 2024-03-06 | In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly |
CVE-2024-28173 | Medium | 4.3 | 2024-03-06 | In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed |
CVE-2024-27199 | High | 7.3 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible |
CVE-2024-27198 | Critical | 9.8 | 2024-03-04 | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
CVE-2024-24943 | Medium | 5.3 | 2024-02-06 | In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image |
CVE-2024-24942 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives |
CVE-2024-24941 | Medium | 6.1 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL |
CVE-2024-24940 | Low | 2.8 | 2024-02-06 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives |
CVE-2024-24939 | Low | 3.3 | 2024-02-06 | In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible |