Jetbrains
Page 4 of 7 — Jetbrains CVEs from a corpus of 649, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-24938 | Medium | 5.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
CVE-2024-24937 | Medium | 4.6 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible |
CVE-2024-24936 | Medium | 4.3 | 2024-02-06 | In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed |
CVE-2024-23917 | Critical | 9.8 | 2024-02-06 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible |
CVE-2024-22370 | Medium | 4.6 | 2024-01-09 | In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible |
CVE-2023-51655 | Medium | 6.3 | 2023-12-21 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project con… |
CVE-2023-50871 | Medium | 4.3 | 2023-12-15 | In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed |
CVE-2023-50870 | Medium | 4.3 | 2023-12-15 | In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible |
CVE-2023-45613 | Medium | 6.8 | 2023-10-09 | In JetBrains Ktor before 2.3.5 server certificates were not verified |
CVE-2023-45612 | High | 8.6 | 2023-10-09 | In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE |
CVE-2023-43566 | Low | 3.5 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration |
CVE-2023-42793 | Critical | 9.8 | 2023-09-19 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
CVE-2023-41250 | Low | 3.5 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration |
CVE-2023-41249 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step |
CVE-2023-41248 | Medium | 4.6 | 2023-08-25 | In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration |
CVE-2023-39261 | Medium | 5.2 | 2023-07-26 | In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions |
CVE-2023-39175 | Medium | 4.6 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible |
CVE-2023-39174 | Medium | 4.3 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers |
CVE-2023-39173 | Medium | 5.4 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access |
CVE-2023-38069 | Low | 3.3 | 2023-07-12 | In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases |
CVE-2023-38068 | Medium | 6.5 | 2023-07-12 | In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms |
CVE-2023-38067 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log |
CVE-2023-38066 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads |
CVE-2023-38065 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible |
CVE-2023-38064 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log |
CVE-2023-38063 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible |
CVE-2023-38062 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations |
CVE-2023-38061 | Medium | 4.6 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible |
CVE-2015-1313 | Medium | 6.5 | 2023-06-29 | JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced b… |
CVE-2023-35054 | Medium | 4.6 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible |
CVE-2023-35053 | High | 7.5 | 2023-06-12 | In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms |
CVE-2023-34339 | Low | 3.3 | 2023-06-01 | In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message |
CVE-2023-34229 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible |
CVE-2023-34228 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions |
CVE-2023-34227 | Medium | 5.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks |
CVE-2023-34226 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible |
CVE-2023-34225 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible |
CVE-2023-34224 | Medium | 4.8 | 2023-05-31 | In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible |
CVE-2023-34223 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases |
CVE-2023-34222 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible |
CVE-2023-34221 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible |
CVE-2023-34220 | Medium | 4.6 | 2023-05-31 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible |
CVE-2023-34219 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API |
CVE-2023-34218 | Critical | 9.1 | 2023-05-31 | In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible |
CVE-2022-48481 | Medium | 5.2 | 2023-04-28 | In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible |
CVE-2022-48477 | Medium | 4.1 | 2023-04-24 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing |
CVE-2022-48476 | High | 7.5 | 2023-04-24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible |
CVE-2022-48435 | Low | 3.3 | 2023-04-04 | In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file |
CVE-2022-48433 | Medium | 6.1 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. |
CVE-2022-48432 | Medium | 5.2 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. |
CVE-2022-48431 | Medium | 4.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. |
CVE-2022-48430 | Medium | 5.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. |
CVE-2022-48428 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
CVE-2022-48427 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible |
CVE-2022-48429 | Medium | 4.6 | 2023-03-27 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible |
CVE-2022-48426 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible |
CVE-2022-48344 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. |
CVE-2022-48343 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-47896 | Medium | 5.0 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. |
CVE-2022-47895 | Medium | 4.7 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-46830 | Medium | 4.1 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-46828 | Medium | 5.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-46824 | Medium | 5.6 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-44646 | Low | 2.2 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings |
CVE-2022-44624 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters |
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-38180 | Medium | 5.3 | 2022-08-12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases |
CVE-2022-38179 | Medium | 4.7 | 2022-08-12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-37010 | Low | 3.6 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed |
CVE-2022-37009 | Low | 3.9 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible |
CVE-2022-36322 | Medium | 5.4 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-29930 | High | 8.7 | 2022-05-12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. |
CVE-2022-29929 | Low | 3.7 | 2022-05-12 | In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible |
CVE-2022-29928 | Medium | 4.4 | 2022-05-12 | In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible |
CVE-2022-29927 | Medium | 4.6 | 2022-05-12 | In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible |
CVE-2022-29821 | Medium | 6.9 | 2022-04-28 | In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2022-29817 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible |
CVE-2022-29816 | Low | 2.8 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2022-29812 | Low | 2.3 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient |
CVE-2022-29811 | Medium | 6.1 | 2022-04-28 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |