Jetbrains
Page 5 of 7 — Jetbrains CVEs from a corpus of 677, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-38180 | Medium | 5.3 | 2022-08-12 | In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases |
CVE-2022-38179 | Medium | 4.7 | 2022-08-12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-37396 | Medium | 4.1 | 2022-08-03 | In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution |
CVE-2022-37010 | Low | 3.6 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed |
CVE-2022-37009 | Low | 3.9 | 2022-07-28 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible |
CVE-2022-36322 | Medium | 5.4 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-34894 | Low | 3.5 | 2022-07-01 | In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services |
CVE-2022-29930 | High | 8.7 | 2022-05-12 | SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1. |
CVE-2022-29929 | Low | 3.7 | 2022-05-12 | In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible |
CVE-2022-29928 | Medium | 4.4 | 2022-05-12 | In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible |
CVE-2022-29927 | Medium | 4.6 | 2022-05-12 | In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible |
CVE-2022-29821 | Medium | 6.9 | 2022-04-28 | In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2022-29817 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible |
CVE-2022-29816 | Low | 2.8 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2022-29812 | Low | 2.3 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient |
CVE-2022-29811 | Medium | 6.1 | 2022-04-28 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |
CVE-2022-29035 | Low | 3.3 | 2022-04-11 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2022-28650 | High | 7.3 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI |
CVE-2022-28649 | Medium | 4.6 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description |
CVE-2022-28648 | Medium | 5.7 | 2022-04-05 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered |
CVE-2022-25264 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. |
CVE-2022-25263 | Critical | 9.8 | 2022-02-25 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. |
CVE-2022-25262 | Critical | 9.8 | 2022-02-25 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. |
CVE-2022-25261 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. |
CVE-2022-25260 | Critical | 9.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). |
CVE-2022-25259 | Medium | 6.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2022-24347 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. |
CVE-2022-24346 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. |
CVE-2022-24345 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. |
CVE-2022-24344 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. |
CVE-2022-24343 | Medium | 4.3 | 2022-02-25 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. |
CVE-2022-24342 | High | 8.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. |
CVE-2022-24341 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. |
CVE-2022-24340 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. |
CVE-2022-24339 | Medium | 5.4 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. |
CVE-2022-24338 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. |
CVE-2022-24337 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. |
CVE-2022-24336 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. |
CVE-2022-24335 | High | 8.1 | 2022-02-25 | JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. |
CVE-2022-24334 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. |
CVE-2022-24333 | Medium | 6.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. |
CVE-2022-24332 | Medium | 5.3 | 2022-02-25 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. |
CVE-2022-24331 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. |
CVE-2022-24330 | Medium | 6.1 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. |
CVE-2022-24329 | Medium | 5.3 | 2022-02-25 | In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. |
CVE-2022-24328 | Medium | 6.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. |
CVE-2022-24327 | High | 7.5 | 2022-02-25 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. |
CVE-2021-45977 | Critical | 9.8 | 2022-02-25 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 202… |
CVE-2021-43202 | Critical | 9.8 | 2021-11-30 | In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. |
CVE-2021-43182 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. |
CVE-2021-43181 | Medium | 6.1 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, stored XSS is possible. |
CVE-2021-43180 | High | 7.5 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. |
CVE-2021-43203 | High | 7.5 | 2021-11-09 | In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. |
CVE-2021-43201 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. |
CVE-2021-43200 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. |
CVE-2021-43199 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
CVE-2021-43198 | Medium | 5.4 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, stored XSS is possible. |
CVE-2021-43197 | Medium | 6.1 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. |
CVE-2021-43196 | High | 7.5 | 2021-11-09 | In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. |
CVE-2021-43195 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. |
CVE-2021-43194 | Medium | 5.3 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, user enumeration was possible. |
CVE-2021-43193 | Critical | 9.8 | 2021-11-09 | In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. |
CVE-2021-43192 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible. |
CVE-2021-43191 | Medium | 5.3 | 2021-11-09 | JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS. |
CVE-2021-43190 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible. |
CVE-2021-43189 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. |
CVE-2021-43188 | High | 7.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. |
CVE-2021-43187 | Medium | 5.3 | 2021-11-09 | In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. |
CVE-2021-43186 | Medium | 5.4 | 2021-11-09 | JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. |
CVE-2021-43185 | Critical | 9.8 | 2021-11-09 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. |
CVE-2021-43184 | Medium | 5.4 | 2021-11-09 | In JetBrains YouTrack before 2021.3.21051, stored XSS is possible. |
CVE-2021-43183 | Critical | 9.8 | 2021-11-09 | In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. |
CVE-2021-37554 | Medium | 4.3 | 2021-08-06 | In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions. |
CVE-2021-37553 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used. |
CVE-2021-37552 | Medium | 5.4 | 2021-08-06 | In JetBrains YouTrack before 2021.2.17925, stored XSS was possible. |
CVE-2021-37551 | Medium | 5.3 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256. |
CVE-2021-37550 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used. |
CVE-2021-37549 | Critical | 9.1 | 2021-08-06 | In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. |
CVE-2021-37548 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS. |
CVE-2021-37547 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made. |
CVE-2021-37546 | Medium | 5.3 | 2021-08-06 | In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. |
CVE-2021-37545 | High | 7.5 | 2021-08-06 | In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. |
CVE-2021-37544 | Critical | 9.8 | 2021-08-06 | In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. |
CVE-2021-37543 | High | 8.8 | 2021-08-06 | In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects. |
CVE-2021-37542 | Medium | 6.1 | 2021-08-06 | In JetBrains TeamCity before 2020.2.3, XSS was possible. |
CVE-2021-37541 | Medium | 6.1 | 2021-08-06 | In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible. |