Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
Medium 4.3
In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit B…
-
Medium 4.6CVE-2023-34220 EPSS 61%
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
-
Critical 9.1
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
-
Medium 5.2
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
-
Medium 4.1
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
-
High 7.5
In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
-
Low 3.3
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built…
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust …
-
Medium 5.5
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown pr…
-
Medium 4.6CVE-2022-48429 Public exploit
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
-
Medium 4.6CVE-2022-48428 EPSS 68%
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
-
Medium 4.6
In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
-
Medium 4.6
In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
-
Medium 5.4
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
-
Medium 5.2
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
-
Medium 5.4CVE-2022-48343 EPSS 59%
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
-
Medium 5.0
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
-
Medium 4.7
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required J…
-
Medium 6.6
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" all…
-
Medium 4.1
In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.
-
High 7.1
In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
-
Low 3.9
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was p…
-
Medium 6.2
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a p…
-
Medium 4.0
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.
-
Medium 5.6
In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.
-
Low 3.5
In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
-
Low 2.7
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
-
Medium 6.5
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained s…
-
Medium 6.5
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settin…
-
Low 2.2
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
-
Medium 4.4
In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Per…
-
High 7.5
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking
-
Medium 5.3
JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider
In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases
-
Medium 4.7
JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
-
Low 3.2
In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
-
Medium 4.1
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution
-
Low 3.6
In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was miss…