Jetbrains
Page 6 of 7 — Jetbrains CVEs from a corpus of 677, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37540 | Medium | 6.5 | 2021-08-06 | In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. |
CVE-2021-36209 | Critical | 9.8 | 2021-08-06 | In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. |
CVE-2021-31915 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. |
CVE-2021-31914 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. |
CVE-2021-31913 | High | 7.5 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange. |
CVE-2021-31912 | High | 8.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset. |
CVE-2021-31911 | Medium | 6.1 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages. |
CVE-2021-31910 | High | 7.5 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible. |
CVE-2021-31898 | High | 7.5 | 2021-05-11 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. |
CVE-2021-31897 | Critical | 9.8 | 2021-05-11 | In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. |
CVE-2021-30482 | High | 7.5 | 2021-05-11 | In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly |
CVE-2021-3315 | Medium | 5.4 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible. |
CVE-2021-31909 | Critical | 9.8 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. |
CVE-2021-31908 | Medium | 5.4 | 2021-05-11 | In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages. |
CVE-2021-31907 | Medium | 5.3 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. |
CVE-2021-31906 | Low | 2.7 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file. |
CVE-2021-31905 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible. |
CVE-2021-31904 | Medium | 6.1 | 2021-05-11 | In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page. |
CVE-2021-31903 | Medium | 6.1 | 2021-05-11 | In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS. |
CVE-2021-31902 | High | 7.5 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. |
CVE-2021-31901 | High | 7.5 | 2021-05-11 | In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. |
CVE-2021-31900 | Medium | 5.3 | 2021-05-11 | In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host. |
CVE-2021-31899 | High | 8.8 | 2021-05-11 | In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode. |
CVE-2021-30504 | High | 7.5 | 2021-05-11 | In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. |
CVE-2021-30006 | High | 7.5 | 2021-05-11 | In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. |
CVE-2021-30005 | High | 7.8 | 2021-05-11 | In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-29263 | High | 7.8 | 2021-05-11 | In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. |
CVE-2021-27733 | Medium | 5.4 | 2021-05-11 | In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment. |
CVE-2021-26310 | High | 7.5 | 2021-05-11 | In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. |
CVE-2021-26309 | Low | 3.3 | 2021-05-11 | Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions. |
CVE-2021-25764 | Medium | 5.3 | 2021-03-18 | In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. |
CVE-2021-25778 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. |
CVE-2021-25777 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. |
CVE-2021-25776 | High | 7.5 | 2021-02-03 | In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. |
CVE-2021-25775 | Low | 3.8 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users. |
CVE-2021-25774 | Medium | 4.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. |
CVE-2021-25773 | Medium | 6.1 | 2021-02-03 | JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. |
CVE-2021-25772 | Medium | 5.3 | 2021-02-03 | In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration. |
CVE-2021-25771 | Medium | 4.3 | 2021-02-03 | In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed. |
CVE-2021-25770 | Critical | 9.8 | 2021-02-03 | In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. |
CVE-2021-25769 | High | 7.5 | 2021-02-03 | In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments. |
CVE-2021-25768 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly. |
CVE-2021-25767 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution. |
CVE-2021-25766 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made. |
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2021-25763 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. |
CVE-2021-25762 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. |
CVE-2021-25761 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. |
CVE-2021-25760 | Medium | 5.3 | 2021-02-03 | In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. |
CVE-2021-25759 | Medium | 6.5 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. |
CVE-2021-25758 | High | 7.8 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. |
CVE-2021-25757 | Medium | 6.1 | 2021-02-03 | In JetBrains Hub before 2020.1.12629, an open redirect was possible. |
CVE-2021-25756 | Medium | 5.3 | 2021-02-03 | In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. |
CVE-2021-25755 | Low | 2.5 | 2021-02-03 | In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic. |
CVE-2020-35667 | High | 7.5 | 2021-02-03 | JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials. |
CVE-2020-29582 | Medium | 5.3 | 2021-02-03 | In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and… |
CVE-2020-25208 | Medium | 5.3 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions. |
CVE-2020-27627 | Medium | 6.1 | 2020-11-16 | JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. |
CVE-2020-27623 | High | 7.5 | 2020-11-16 | JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances. |
CVE-2020-27622 | Medium | 5.3 | 2020-11-16 | In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. |
CVE-2020-26129 | Medium | 6.5 | 2020-11-16 | In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. |
CVE-2020-27629 | Medium | 5.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts. |
CVE-2020-27628 | Medium | 4.3 | 2020-11-16 | In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. |
CVE-2020-27626 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. |
CVE-2020-27625 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. |
CVE-2020-27624 | Medium | 5.3 | 2020-11-16 | JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. |
CVE-2020-25210 | Medium | 5.3 | 2020-11-16 | In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. |
CVE-2020-25209 | High | 7.5 | 2020-11-16 | In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. |
CVE-2020-25207 | Critical | 9.8 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. |
CVE-2020-25013 | High | 7.5 | 2020-11-16 | JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. |
CVE-2020-24366 | Low | 3.3 | 2020-11-16 | Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. |
CVE-2020-15822 | High | 7.3 | 2020-10-19 | In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. |
CVE-2020-24618 | Medium | 6.5 | 2020-08-27 | In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue… |
CVE-2020-15831 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. |
CVE-2020-15830 | Medium | 6.1 | 2020-08-08 | JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI. |
CVE-2020-15829 | Medium | 5.3 | 2020-08-08 | In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. |
CVE-2020-15828 | Medium | 6.5 | 2020-08-08 | In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. |
CVE-2020-15827 | High | 7.5 | 2020-08-08 | In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. |
CVE-2020-15826 | Medium | 4.3 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have. |
CVE-2020-15825 | High | 8.8 | 2020-08-08 | In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges. |
CVE-2020-15824 | High | 8.8 | 2020-08-08 | In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation… |
CVE-2020-15823 | High | 7.5 | 2020-08-08 | JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component. |
CVE-2020-15821 | Medium | 6.5 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. |
CVE-2020-15820 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence. |
CVE-2020-15819 | Medium | 5.3 | 2020-08-08 | JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports. |
CVE-2020-15818 | Medium | 5.3 | 2020-08-08 | In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence. |
CVE-2020-15817 | High | 8.8 | 2020-08-08 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. |
CVE-2019-19704 | High | 7.5 | 2020-08-08 | In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm. |
CVE-2020-11938 | Medium | 4.9 | 2020-04-22 | In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved… |
CVE-2020-11796 | Critical | 9.8 | 2020-04-22 | In JetBrains Space through 2020-04-22, the password authentication implementation was insecure. |
CVE-2020-11795 | High | 7.5 | 2020-04-22 | In JetBrains Space through 2020-04-22, the session timeout period was configured improperly. |
CVE-2020-11693 | High | 7.5 | 2020-04-22 | JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue. |
CVE-2020-11692 | Low | 2.7 | 2020-04-22 | In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators. |
CVE-2020-11691 | High | 7.5 | 2020-04-22 | In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible. |
CVE-2020-11690 | Critical | 9.8 | 2020-04-22 | In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. |
CVE-2020-11689 | Medium | 6.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file. |
CVE-2020-11688 | High | 7.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session. |
CVE-2020-11687 | High | 7.5 | 2020-04-22 | In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. |
CVE-2020-11686 | Low | 2.7 | 2020-04-22 | In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings. |
CVE-2020-11685 | High | 7.5 | 2020-04-22 | In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. |