Jetbrains
Page 4 of 7 — Jetbrains CVEs from a corpus of 602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48435 | Low | 3.3 | 2023-04-04 | In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file |
CVE-2022-48433 | Medium | 6.1 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. |
CVE-2022-48432 | Medium | 5.2 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. |
CVE-2022-48431 | Medium | 4.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. |
CVE-2022-48430 | Medium | 5.5 | 2023-03-29 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. |
CVE-2022-48428 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
CVE-2022-48427 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible |
CVE-2022-48429 | Medium | 4.6 | 2023-03-27 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible |
CVE-2022-48426 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible |
CVE-2022-48344 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. |
CVE-2022-48343 | Medium | 5.4 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
CVE-2022-48342 | Medium | 5.2 | 2023-02-23 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
CVE-2022-47896 | Medium | 5.0 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. |
CVE-2022-47895 | Medium | 4.7 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
CVE-2022-46831 | Medium | 6.6 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to… |
CVE-2022-46830 | Medium | 4.1 | 2022-12-08 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
CVE-2022-46829 | High | 7.1 | 2022-12-08 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
CVE-2022-46828 | Medium | 5.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. |
CVE-2022-46827 | Low | 3.9 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
CVE-2022-46826 | Medium | 6.2 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |
CVE-2022-46825 | Medium | 4.0 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. |
CVE-2022-46824 | Medium | 5.6 | 2022-12-08 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-44646 | Low | 2.2 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings |
CVE-2022-44624 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters |
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-38180 | Medium | 5.3 | 2022-08-12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases |
CVE-2022-38179 | Medium | 4.7 | 2022-08-12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-37010 | Low | 3.6 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed |
CVE-2022-37009 | Low | 3.9 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible |
CVE-2022-36322 | Medium | 5.4 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-29930 | High | 8.7 | 2022-05-12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. |
CVE-2022-29929 | Low | 3.7 | 2022-05-12 | In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible |
CVE-2022-29928 | Medium | 4.4 | 2022-05-12 | In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible |
CVE-2022-29927 | Medium | 4.6 | 2022-05-12 | In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible |
CVE-2022-29821 | Medium | 6.9 | 2022-04-28 | In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2022-29817 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible |
CVE-2022-29816 | Low | 2.8 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2022-29812 | Low | 2.3 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient |
CVE-2022-29811 | Medium | 6.1 | 2022-04-28 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |
CVE-2022-29035 | Low | 3.3 | 2022-04-11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2022-28650 | High | 7.3 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI |
CVE-2022-28649 | Medium | 4.6 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description |
CVE-2022-28648 | Medium | 5.7 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered |
CVE-2022-25264 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. |
CVE-2022-25263 | Critical | 9.8 | 2022-02-25 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. |
CVE-2022-25262 | Critical | 9.8 | 2022-02-25 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. |
CVE-2022-25261 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. |
CVE-2022-25260 | Critical | 9.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). |
CVE-2022-25259 | Medium | 6.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2022-24347 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. |
CVE-2022-24346 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. |
CVE-2022-24345 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. |
CVE-2022-24344 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. |
CVE-2022-24343 | Medium | 4.3 | 2022-02-25 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. |
CVE-2022-24342 | High | 8.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. |
CVE-2022-24341 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. |
CVE-2022-24340 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. |
CVE-2022-24339 | Medium | 5.4 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. |
CVE-2022-24338 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. |
CVE-2022-24337 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. |
CVE-2022-24336 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. |
CVE-2022-24335 | High | 8.1 | 2022-02-25 | JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. |
CVE-2022-24334 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. |
CVE-2022-24333 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. |
CVE-2022-24332 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. |
CVE-2022-24331 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. |
CVE-2022-24330 | Medium | 6.1 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. |
CVE-2022-24329 | Medium | 5.3 | 2022-02-25 | In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. |
CVE-2022-24328 | Medium | 6.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. |
CVE-2022-24327 | High | 7.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. |
CVE-2021-45977 | Critical | 9.8 | 2022-02-25 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 202… |
CVE-2021-43202 | Critical | 9.8 | 2021-11-30 | In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. |
CVE-2021-43182 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. |
CVE-2021-43181 | Medium | 6.1 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, stored XSS is possible. |
CVE-2021-43180 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. |
CVE-2021-43203 | High | 7.5 | 2021-11-09 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. |
CVE-2021-43201 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. |
CVE-2021-43200 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. |
CVE-2021-43199 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
CVE-2021-43198 | Medium | 5.4 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, stored XSS is possible. |
CVE-2021-43197 | Medium | 6.1 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. |
CVE-2021-43196 | High | 7.5 | 2021-11-09 | In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. |
CVE-2021-43195 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. |
CVE-2021-43194 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, user enumeration was possible. |