Jetbrains
Page 5 of 7 — Jetbrains CVEs from a corpus of 602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43193 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. |
CVE-2021-43192 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible. |
CVE-2021-43191 | Medium | 5.3 | 2021-11-09 | JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS. |
CVE-2021-43190 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible. |
CVE-2021-43189 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. |
CVE-2021-43188 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. |
CVE-2021-43187 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. |
CVE-2021-43186 | Medium | 5.4 | 2021-11-09 | JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. |
CVE-2021-43185 | Critical | 9.8 | 2021-11-09 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. |
CVE-2021-43184 | Medium | 5.4 | 2021-11-09 | In JetBrains YouTrack before 2021.3.21051, stored XSS is possible. |
CVE-2021-43183 | Critical | 9.8 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. |
CVE-2021-37554 | Medium | 4.3 | 2021-08-06 | In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions. |
CVE-2021-37553 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used. |
CVE-2021-37552 | Medium | 5.4 | 2021-08-06 | In JetBrains YouTrack before 2021.2.17925, stored XSS was possible. |
CVE-2021-37551 | Medium | 5.3 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256. |
CVE-2021-37550 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used. |
CVE-2021-37549 | Critical | 9.1 | 2021-08-06 | In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. |
CVE-2021-37548 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS. |
CVE-2021-37547 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made. |
CVE-2021-37546 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. |
CVE-2021-37545 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. |
CVE-2021-37544 | Critical | 9.8 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. |
CVE-2021-37543 | High | 8.8 | 2021-08-06 | In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects. |
CVE-2021-37542 | Medium | 6.1 | 2021-08-06 | In JetBrains TeamCity before 2020.2.3, XSS was possible. |
CVE-2021-37541 | Medium | 6.1 | 2021-08-06 | In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible. |
CVE-2021-37540 | Medium | 6.5 | 2021-08-06 | In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. |
CVE-2021-36209 | Critical | 9.8 | 2021-08-06 | In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. |
CVE-2021-31915 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. |
CVE-2021-31914 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. |
CVE-2021-31913 | High | 7.5 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange. |
CVE-2021-31912 | High | 8.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset. |
CVE-2021-31911 | Medium | 6.1 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages. |
CVE-2021-31910 | High | 7.5 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible. |
CVE-2021-31898 | High | 7.5 | 2021-05-11 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. |
CVE-2021-31897 | Critical | 9.8 | 2021-05-11 | In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. |
CVE-2021-30482 | High | 7.5 | 2021-05-11 | In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly |
CVE-2021-3315 | Medium | 5.4 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible. |
CVE-2021-31909 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. |
CVE-2021-31908 | Medium | 5.4 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages. |
CVE-2021-31907 | Medium | 5.3 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. |
CVE-2021-31906 | Low | 2.7 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file. |
CVE-2021-31905 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible. |
CVE-2021-31904 | Medium | 6.1 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page. |
CVE-2021-31903 | Medium | 6.1 | 2021-05-11 | In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS. |
CVE-2021-31902 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. |
CVE-2021-31901 | High | 7.5 | 2021-05-11 | In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. |
CVE-2021-31900 | Medium | 5.3 | 2021-05-11 | In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host. |
CVE-2021-31899 | High | 8.8 | 2021-05-11 | In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode. |
CVE-2021-30504 | High | 7.5 | 2021-05-11 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. |
CVE-2021-30006 | High | 7.5 | 2021-05-11 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. |
CVE-2021-30005 | High | 7.8 | 2021-05-11 | In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-29263 | High | 7.8 | 2021-05-11 | In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-27733 | Medium | 5.4 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment. |
CVE-2021-26310 | High | 7.5 | 2021-05-11 | In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. |
CVE-2021-26309 | Low | 3.3 | 2021-05-11 | Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions. |
CVE-2021-25764 | Medium | 5.3 | 2021-03-18 | In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. |
CVE-2021-25778 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. |
CVE-2021-25777 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. |
CVE-2021-25776 | High | 7.5 | 2021-02-03 | In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. |
CVE-2021-25775 | Low | 3.8 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users. |
CVE-2021-25774 | Medium | 4.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. |
CVE-2021-25773 | Medium | 6.1 | 2021-02-03 | JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. |
CVE-2021-25772 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration. |
CVE-2021-25771 | Medium | 4.3 | 2021-02-03 | In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed. |
CVE-2021-25770 | Critical | 9.8 | 2021-02-03 | In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. |
CVE-2021-25769 | High | 7.5 | 2021-02-03 | In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments. |
CVE-2021-25768 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly. |
CVE-2021-25767 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution. |
CVE-2021-25766 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made. |
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2021-25763 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. |
CVE-2021-25762 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. |
CVE-2021-25761 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. |
CVE-2021-25760 | Medium | 5.3 | 2021-02-03 | In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. |
CVE-2021-25759 | Medium | 6.5 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. |
CVE-2021-25758 | High | 7.8 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. |
CVE-2021-25757 | Medium | 6.1 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an open redirect was possible. |
CVE-2021-25756 | Medium | 5.3 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. |
CVE-2021-25755 | Low | 2.5 | 2021-02-03 | In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic. |
CVE-2020-35667 | High | 7.5 | 2021-02-03 | JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials. |
CVE-2020-29582 | Medium | 5.3 | 2021-02-03 | In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and… |
CVE-2020-25208 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions. |
CVE-2020-27627 | Medium | 6.1 | 2020-11-16 | JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. |
CVE-2020-27623 | High | 7.5 | 2020-11-16 | JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances. |
CVE-2020-27622 | Medium | 5.3 | 2020-11-16 | In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. |
CVE-2020-26129 | Medium | 6.5 | 2020-11-16 | In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. |
CVE-2020-27629 | Medium | 5.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts. |
CVE-2020-27628 | Medium | 4.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. |
CVE-2020-27626 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. |
CVE-2020-27625 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. |
CVE-2020-27624 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. |
CVE-2020-25210 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. |
CVE-2020-25209 | High | 7.5 | 2020-11-16 | In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. |
CVE-2020-25207 | Critical | 9.8 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. |
CVE-2020-25013 | High | 7.5 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. |
CVE-2020-24366 | Low | 3.3 | 2020-11-16 | Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. |
CVE-2020-15822 | High | 7.3 | 2020-10-19 | In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. |
CVE-2020-24618 | Medium | 6.5 | 2020-08-27 | In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue… |
CVE-2020-15831 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. |
CVE-2020-15830 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI. |