JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-64773In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
- CVE-2025-64457In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition
- CVE-2025-64456In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation
- CVE-2025-64685In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
- CVE-2025-64684In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
- CVE-2025-64683In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
- CVE-2025-64682In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
- CVE-2025-64681In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
- CVE-2025-59458In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28
- CVE-2025-59457In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
- CVE-2025-59456In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
- CVE-2025-59455In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
- CVE-2025-58335In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.28
- CVE-2025-58334In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for t
- CVE-2025-57734In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
- CVE-2025-57733In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
- CVE-2025-57732In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
- CVE-2025-57731In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
- CVE-2025-57730In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature
- CVE-2025-57729In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
- CVE-2025-57728In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
- CVE-2025-57727In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
- CVE-2025-54538In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
- CVE-2025-54537In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
- CVE-2025-54536In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
- CVE-2025-54535In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
- CVE-2025-54534In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
- CVE-2025-54533In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
- CVE-2025-54532In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
- CVE-2025-54531In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows