JetBrains vulnerabilities
545 CVEs and advisories name JetBrains as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-34220In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
- CVE-2023-34219In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration se
- CVE-2023-34218In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
- CVE-2022-48481In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
- CVE-2022-48477In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
- CVE-2022-48476In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
- CVE-2022-48435In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
- CVE-2022-48433In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
- CVE-2022-48432In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
- CVE-2022-48431In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation
- CVE-2022-48430In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
- CVE-2022-48429In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
- CVE-2022-48428In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
- CVE-2022-48427In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
- CVE-2022-48426In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
- CVE-2022-48344In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
- CVE-2022-48343In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
- CVE-2022-48342In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
- CVE-2022-47896In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
- CVE-2022-47895In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.
- CVE-2022-46831In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project
- CVE-2022-46830In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.
- CVE-2022-46829In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
- CVE-2022-46828In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
- CVE-2022-46827In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.
- CVE-2022-46826In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnera
- CVE-2022-46825In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.
- CVE-2022-46824In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.
- CVE-2022-45471In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
- CVE-2022-44646In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings