JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-31139In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
- CVE-2024-31138In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
- CVE-2024-31137In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
- CVE-2024-31136In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
- CVE-2024-31135In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
- CVE-2024-31134In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratio
- CVE-2024-29880In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process
- CVE-2024-28230In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions
- CVE-2024-28229In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles
- CVE-2024-28228In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
- CVE-2024-28174In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly
- CVE-2024-28173In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
- CVE-2024-27199In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
- CVE-2024-24943In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
- CVE-2024-23917In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
- CVE-2024-24942In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
- CVE-2024-24941In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL
- CVE-2024-24940In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
- CVE-2024-24939In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
- CVE-2024-24938In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
- CVE-2024-24937In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
- CVE-2024-24936In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
- CVE-2024-22370In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible
- CVE-2023-51655In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified
- CVE-2023-50871In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
- CVE-2023-50870In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible
- CVE-2023-45613In JetBrains Ktor before 2.3.5 server certificates were not verified
- CVE-2023-45612In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE
- CVE-2023-43566In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration