JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-39879In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings
- CVE-2024-39878In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection
- CVE-2024-38507In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
- CVE-2024-38506In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows
- CVE-2024-38505In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site
- CVE-2024-38504In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
- CVE-2024-37051GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7…
- CVE-2024-36470In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases
- CVE-2024-36378In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens
- CVE-2024-36377In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions
- CVE-2024-36376In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions
- CVE-2024-36375In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed
- CVE-2024-36374In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
- CVE-2024-36373In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
- CVE-2024-36372In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible
- CVE-2024-36371In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible
- CVE-2024-36370In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible
- CVE-2024-36369In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
- CVE-2024-36368In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible
- CVE-2024-36367In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
- CVE-2024-36366In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering o
- CVE-2024-36365In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
- CVE-2024-36364In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher
- CVE-2024-36363In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible
- CVE-2024-36362In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was pos
- CVE-2024-35302In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
- CVE-2024-35301In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
- CVE-2024-35300In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
- CVE-2024-35299In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation
- CVE-2024-31140In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools