Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
308 results · Clear filters · Feed
-
Medium 5.9
In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens
-
Medium 6.5
In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions
-
Medium 6.5
In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their …
-
Medium 5.3
In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed
-
Medium 4.6
In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
-
Medium 4.6
In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible
-
Medium 4.6
In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible
-
Medium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was po…
-
Medium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration …
-
Medium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was po…
-
Medium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
-
Medium 6.8
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonat…
-
Medium 5.4
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report gro…
-
Medium 4.6
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports w…
-
Medium 6.5
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Co…
-
Medium 6.5
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read file…
-
Medium 5.4
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
-
Medium 5.5
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
-
Medium 5.9
In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation
-
Medium 4.1
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing t…
-
Medium 5.9
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
-
Medium 4.6CVE-2024-31138 EPSS 75%
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
-
Medium 6.8
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
-
Medium 6.5
In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users …
-
Medium 6.1
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
-
Medium 4.2
In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user runnin…
-
Medium 6.5
In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin …
-
Medium 5.3
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
-
Medium 6.5
In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
-
Medium 4.3
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
-
Medium 5.8
In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized …
-
Medium 5.3
In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
-
Medium 5.3CVE-2024-24942 EPSS 32%
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an …
-
Medium 5.3
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
-
Medium 4.6
In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
-
Medium 4.3
In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
-
Medium 4.6
In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
-
Medium 6.3
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin…