Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
308 results · Clear filters · Feed
-
Medium 5.5
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
-
Medium 6.5
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
-
Medium 6.5
In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
-
Medium 5.5
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
-
Medium 5.5
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
-
Medium 5.8
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
-
Medium 4.8
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
-
Medium 4.3
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependen…
-
Medium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
-
Medium 6.1
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in wi…
-
Medium 4.3
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
-
Medium 4.8
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
-
Medium 5.4CVE-2025-52876 EPSS 39%
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
-
Medium 4.8CVE-2025-52877 EPSS 37%
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
-
Medium 5.4
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
-
Medium 4.3
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
-
Medium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
-
Medium 4.3
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
-
Medium 4.3
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
-
Medium 4.9
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
-
Medium 5.4
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session
-
Medium 6.1
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
-
Medium 6.9
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
-
Medium 4.2
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
-
Medium 4.6CVE-2025-31140 EPSS 28%
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
-
Medium 4.3
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
-
Medium 4.1
In JetBrains GoLand before 2025.1 an XXE during debugging was possible
-
Medium 5.2
In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
-
Medium 5.3
-
Medium 4.6
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
-
Medium 4.3
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
-
Medium 6.5
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Tes…
-
Medium 4.6
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
-
Medium 5.5
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs