JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-50579In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible
- CVE-2024-50578In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
- CVE-2024-50577In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
- CVE-2024-50576In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
- CVE-2024-50575In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API
- CVE-2024-50574In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality
- CVE-2024-50573In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services
- CVE-2024-49580In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure
- CVE-2024-49579In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
- CVE-2024-48902In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP
- CVE-2024-47951In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
- CVE-2024-47950In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
- CVE-2024-47949In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
- CVE-2024-47948In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
- CVE-2024-47161In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
- CVE-2024-47162In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page
- CVE-2024-47160In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible
- CVE-2024-47159In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project
- CVE-2024-46970In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible
- CVE-2024-43810In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
- CVE-2024-43809In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
- CVE-2024-43808In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
- CVE-2024-43807In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
- CVE-2024-43114In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
- CVE-2024-41829In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
- CVE-2024-41828In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
- CVE-2024-41827In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
- CVE-2024-41826In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
- CVE-2024-41825In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
- CVE-2024-41824In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases