JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-54530In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
- CVE-2025-54529In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
- CVE-2025-54528In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
- CVE-2025-54527In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allow
- CVE-2025-53959In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible
- CVE-2025-52879In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
- CVE-2025-52878In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
- CVE-2025-52877In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
- CVE-2025-52876In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
- CVE-2025-52875In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
- CVE-2025-47854In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
- CVE-2025-47853In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
- CVE-2025-47852In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
- CVE-2025-47851In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
- CVE-2025-47850In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
- CVE-2025-48391In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
- CVE-2025-46618In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
- CVE-2025-46433In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
- CVE-2025-46432In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
- CVE-2025-43016In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session
- CVE-2025-43015In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces
- CVE-2025-43014In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
- CVE-2025-43013In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
- CVE-2025-43012In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
- CVE-2025-42921In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin
- CVE-2025-32054In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file
- CVE-2025-31141In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
- CVE-2025-31140In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
- CVE-2025-31139In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
- CVE-2025-29932In JetBrains GoLand before 2025.1 an XXE during debugging was possible