Skip to contentJetbrains vulnerabilities
Newest
- jetbrains youtrackIn JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files...CVE-2024-385044.3 Medium
- jetbrains aqua, clion, datagrip +10 more +12 moreGitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1...CVE-2024-37051Public exploit9.3 Critical
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge casesCVE-2024-364708.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokensCVE-2024-363785.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissionsCVE-2024-363776.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissionsCVE-2024-363766.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposedCVE-2024-363755.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possibleCVE-2024-363744.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possibleCVE-2024-363734.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possibleCVE-2024-363724.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possibleCVE-2024-363714.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possibleCVE-2024-363704.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possibleCVE-2024-363694.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possibleCVE-2024-363684.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possibleCVE-2024-363674.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operationsCVE-2024-363665.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agentCVE-2024-363656.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possibleCVE-2024-363646.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possibleCVE-2024-363634.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possibleCVE-2024-363626.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possibleCVE-2024-353025.4 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the...CVE-2024-353015.5 Medium
- jetbrains teamcityIn JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates...CVE-2024-353003.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper...CVE-2024-352995.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the...CVE-2024-311404.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detectorCVE-2024-311395.9 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsCVE-2024-31138EPSS 74.7%4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configurationCVE-2024-311376.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameterCVE-2024-311367.4 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 open redirect was possible on the login pageCVE-2024-311356.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could...CVE-2024-311346.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain...CVE-2024-298804.2 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible...CVE-2024-282306.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore...CVE-2024-282296.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in...CVE-2024-282285.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage...CVE-2024-281745.8 Medium
- jetbrains teamcityIn JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password"...CVE-2024-281734.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions ...CVE-2024-27199In KEVPublic exploitEPSS 100.0%7.3 High
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions...CVE-2024-27198In KEVPublic exploitEPSS 99.9%9.8 Critical
- jetbrains toolbox, toolbox app +1 moreIn JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG imageCVE-2024-249435.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archivesCVE-2024-24942EPSS 32.0%5.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possibleCVE-2024-23917EPSS 54.0%9.8 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an...CVE-2024-249416.1 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesCVE-2024-249402.8 Low
- jetbrains riderIn JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was...CVE-2024-249393.3 Low
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL...CVE-2024-249385.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possibleCVE-2024-249374.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint...CVE-2024-249364.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleCVE-2024-223704.6 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode...CVE-2023-516556.3 Medium
- Show moreLoading…