Jetbrains
Page 6 of 7 — Jetbrains CVEs from a corpus of 602, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15829 | Medium | 5.3 | 2020-08-08 | In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. |
CVE-2020-15828 | Medium | 6.5 | 2020-08-08 | In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. |
CVE-2020-15827 | High | 7.5 | 2020-08-08 | In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. |
CVE-2020-15826 | Medium | 4.3 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. |
CVE-2020-15825 | High | 8.8 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges. |
CVE-2020-15824 | High | 8.8 | 2020-08-08 | In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation… |
CVE-2020-15823 | High | 7.5 | 2020-08-08 | JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component. |
CVE-2020-15821 | Medium | 6.5 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. |
CVE-2020-15820 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence. |
CVE-2020-15819 | Medium | 5.3 | 2020-08-08 | JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports. |
CVE-2020-15818 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence. |
CVE-2020-15817 | High | 8.8 | 2020-08-08 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. |
CVE-2019-19704 | High | 7.5 | 2020-08-08 | In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm. |
CVE-2020-11938 | Medium | 4.9 | 2020-04-22 | In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved… |
CVE-2020-11796 | Critical | 9.8 | 2020-04-22 | In JetBrains Space through 2020-04-22, the password authentication implementation was insecure. |
CVE-2020-11795 | High | 7.5 | 2020-04-22 | In JetBrains Space through 2020-04-22, the session timeout period was configured improperly. |
CVE-2020-11693 | High | 7.5 | 2020-04-22 | JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue. |
CVE-2020-11692 | Low | 2.7 | 2020-04-22 | In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators. |
CVE-2020-11691 | High | 7.5 | 2020-04-22 | In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible. |
CVE-2020-11690 | Critical | 9.8 | 2020-04-22 | In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. |
CVE-2020-11689 | Medium | 6.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file. |
CVE-2020-11688 | High | 7.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session. |
CVE-2020-11687 | High | 7.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. |
CVE-2020-11686 | Low | 2.7 | 2020-04-22 | In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings. |
CVE-2020-11685 | High | 7.5 | 2020-04-22 | In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. |
CVE-2020-11416 | Medium | 5.4 | 2020-04-22 | JetBrains Space through 2020-04-22 allows stored XSS in Chats. |
CVE-2020-11694 | High | 7.5 | 2020-04-10 | In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3. |
CVE-2020-7907 | High | 7.5 | 2020-02-21 | In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections. |
CVE-2020-7914 | High | 7.5 | 2020-01-31 | In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 201… |
CVE-2020-7913 | Medium | 6.1 | 2020-01-30 | JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description. |
CVE-2020-7912 | Medium | 5.3 | 2020-01-30 | In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups. |
CVE-2020-7911 | Medium | 6.1 | 2020-01-30 | In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS. |
CVE-2020-7910 | Medium | 5.4 | 2020-01-30 | JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. |
CVE-2020-7909 | High | 7.5 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI. |
CVE-2020-7908 | Medium | 4.3 | 2020-01-30 | In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages. |
CVE-2020-7906 | High | 7.5 | 2020-01-30 | In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release ve… |
CVE-2020-7905 | High | 7.5 | 2020-01-30 | Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network. |
CVE-2020-7904 | High | 7.4 | 2020-01-30 | In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS. |
CVE-2020-5207 | Medium | 5.4 | 2020-01-27 | In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't ha… |
CVE-2019-18412 | High | 7.5 | 2020-01-15 | JetBrains IDETalk plugin before version 193.4099.10 allows XXE |
CVE-2019-19389 | Medium | 5.4 | 2019-12-26 | JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting. |
CVE-2019-19703 | Medium | 6.1 | 2019-12-10 | In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location. |
CVE-2019-18369 | Medium | 5.3 | 2019-10-31 | In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible. |
CVE-2019-18368 | High | 7.3 | 2019-10-31 | In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible. |
CVE-2019-18367 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions. |
CVE-2019-18366 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission. |
CVE-2019-18365 | Medium | 4.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages. |
CVE-2019-18364 | Critical | 9.8 | 2019-10-31 | In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. |
CVE-2019-18363 | Medium | 5.3 | 2019-10-31 | In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances. |
CVE-2019-18362 | Medium | 5.3 | 2019-10-31 | JetBrains MPS before 2019.2.2 exposed listening ports to the network. |
CVE-2019-18361 | Medium | 5.3 | 2019-10-31 | JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution. |
CVE-2019-18360 | Medium | 5.3 | 2019-10-31 | In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery. |
CVE-2019-16407 | High | 7.3 | 2019-10-02 | JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. |
CVE-2019-16171 | Medium | 6.1 | 2019-10-02 | In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. |
CVE-2019-15040 | High | 8.8 | 2019-10-02 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
CVE-2019-15037 | Medium | 6.1 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1. |
CVE-2019-15036 | High | 7.2 | 2019-10-02 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed i… |
CVE-2019-14959 | Medium | 5.9 | 2019-10-02 | JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection. |
CVE-2019-14958 | High | 7.5 | 2019-10-02 | JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a r… |
CVE-2019-14956 | Medium | 4.3 | 2019-10-02 | JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names. |
CVE-2019-12737 | Medium | 5.3 | 2019-10-02 | UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. |
CVE-2019-12736 | Critical | 9.8 | 2019-10-02 | JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. |
CVE-2019-12157 | Critical | 9.8 | 2019-10-02 | In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. |
CVE-2019-12156 | Medium | 5.3 | 2019-10-02 | Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2… |
CVE-2019-15041 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere. |
CVE-2019-15035 | Medium | 4.9 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The is… |
CVE-2019-15042 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 20… |
CVE-2019-14961 | Medium | 6.1 | 2019-10-01 | JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS. |
CVE-2019-15038 | High | 7.5 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2… |
CVE-2019-14960 | High | 7.8 | 2019-10-01 | JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. |
CVE-2019-14957 | Medium | 5.3 | 2019-10-01 | The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a… |
CVE-2019-14955 | Medium | 5.3 | 2019-10-01 | In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implement… |
CVE-2019-14953 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser. |
CVE-2019-15039 | Critical | 9.8 | 2019-10-01 | An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1. |
CVE-2019-14954 | Medium | 5.9 | 2019-10-01 | JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection. |
CVE-2019-14952 | Medium | 6.1 | 2019-10-01 | JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles. |
CVE-2019-15848 | Medium | 6.1 | 2019-09-05 | JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server… |
CVE-2019-12852 | Critical | 9.8 | 2019-07-03 | An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. |
CVE-2019-12846 | Medium | 4.3 | 2019-07-03 | A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2. |
CVE-2019-12845 | Medium | 5.3 | 2019-07-03 | The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3. |
CVE-2019-12844 | Medium | 6.1 | 2019-07-03 | A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3. |
CVE-2019-12843 | Medium | 6.1 | 2019-07-03 | A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3. |
CVE-2019-12842 | Medium | 6.1 | 2019-07-03 | A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2. |
CVE-2019-12841 | High | 7.5 | 2019-07-03 | Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2. |
CVE-2019-10103 | High | 8.1 | 2019-07-03 | JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potenti… |
CVE-2019-10102 | High | 8.1 | 2019-07-03 | JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build proce… |
CVE-2019-10101 | High | 8.1 | 2019-07-03 | JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. |
CVE-2019-9873 | Critical | 9.8 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server cred… |
CVE-2019-9872 | High | 8.1 | 2019-07-03 | In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted reco… |
CVE-2019-9823 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server… |
CVE-2019-9186 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configu… |
CVE-2019-12867 | Critical | 9.8 | 2019-07-03 | Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. |
CVE-2019-12866 | Critical | 9.8 | 2019-07-03 | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4… |
CVE-2019-12851 | High | 8.8 | 2019-07-03 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |
CVE-2019-12850 | Critical | 9.8 | 2019-07-03 | A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. |
CVE-2019-12847 | High | 7.2 | 2019-07-03 | In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in case… |
CVE-2019-10104 | Critical | 9.8 | 2019-07-03 | In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting… |
CVE-2019-10100 | Critical | 9.8 | 2019-07-03 | In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue mac… |
CVE-2018-14878 | High | 7.8 | 2018-08-13 | JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or… |
CVE-2017-8316 | High | 7.5 | 2018-08-03 | IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both A… |