Vendor
JetBrains
545 known vulnerabilities.
Products
TeamCity 191
YouTrack 141
IntelliJ IDEA 94
Hub 25
Datalore 19
Ktor 14
WebStorm 10
PyCharm 10
Toolbox App 10
Rider 9
GoLand 9
PhpStorm 8
CLion 7
Junie CLI 4
RubyMine 4
DataGrip 3
RustRover 3
Junie 3
ReSharper 2
DataSpell 2
Junie GitHub Action 2
dotTrace 1
ETW Host Service 1
ReSharper, Rider and dotTrace 1
Kotlin 1
IDE Services 1
Exposed 1
Runtime 1
JetBrains Gateway 1
Aqua 1
MPS 1
TeamCity < 2023.05.4 0
IntelliJ IDEA < 2023.1 0
TeamCity < 2023.05.3 0
TeamCity < 2023.05 0
IntelliJ IDEA < 2022.2.4 0
IntelliJ IDEA < 2022.3 0
TeamCity < 2023.11.1 0
PhpStorm < 2023.1 0
IntelliJ IDEA < 2022.3.1 0
545 results · Feed
-
High 8.3
In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces
-
High 8.3
In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
-
Medium 6.1
In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
-
Medium 6.9
In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
-
Medium 4.2
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
-
Low 3.3
In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
-
Medium 4.6CVE-2025-31140 EPSS 28%
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
-
Low 2.7
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
-
Medium 4.3
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
-
Medium 4.1
In JetBrains GoLand before 2025.1 an XXE during debugging was possible
-
Medium 5.2
In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
-
Medium 5.3
-
High 7.7
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
-
Medium 4.6
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
-
High 7.8
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace…
-
Medium 4.3
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
-
Medium 6.5
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Tes…
-
Medium 4.6
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
-
High 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
-
Medium 5.5
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
-
Medium 6.7
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
-
Medium 5.9
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
-
Medium 4.6
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
-
Medium 5.5
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
-
Medium 5.5
In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
-
Medium 6.3
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
-
Medium 4.6
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
-
Medium 5.3
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
-
Medium 4.3
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
-
Medium 4.3CVE-2024-56348 Public exploit
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
-
Medium 4.3
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
-
Low 3.5
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
-
Medium 4.2
In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
-
Low 3.7
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import wi…
-
High 8.0
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
-
Low 3.1
In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query pa…
-
Medium 6.3
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installe…
-
Medium 4.6
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
-
Medium 4.6
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom render…
-
Medium 4.6
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag