Browse CVEs

MEDIUM 6.1 CVE-2022-48344 In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. Teamcity 2022.10.2+ Fix from $1,6002023-02-23 HIGH 7.8 CVE-2022-47896 In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. Intellij Idea 2022.3.1+ Fix from $1,9502022-12-22 HIGH 7.5 CVE-2022-47895 In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. Intellij Idea 2022.3.1+ Fix from $1,9502022-12-22 HIGH 8.8 CVE-2022-46829 In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. Jetbrains Gateway 2022.3+ Fix from $1,9502022-12-08 HIGH 7.8 CVE-2022-46828 In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. Intellij Idea 2022.3+ Fix from $1,9502022-12-08 MEDIUM 5.5 CVE-2022-46826 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. Intellij Idea 2022.3+ Fix from $1,6002022-12-08 MEDIUM 5.5 CVE-2022-46827 In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. Intellij Idea 2022.3+ Fix from $1,6002022-12-08 MEDIUM 5.3 CVE-2022-46830 In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. Teamcity after 2022.10.1 Fix from $1,6002022-12-08 HIGH 7.8 CVE-2022-46824 In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. Intellij Idea 2022.2.4+ Fix from $1,9502022-12-08 HIGH 7.5 CVE-2022-45471 In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address Hub 2022.3.15181+ Fix from $1,9502022-11-18 MEDIUM 5.3 CVE-2022-44646 In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings Teamcity 2022.10+ Fix from $1,6002022-11-03 HIGH 7.5 CVE-2022-44624 In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters Teamcity 2022.10+ Fix from $1,9502022-11-03 HIGH 7.5 CVE-2022-44623 In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings Teamcity 2022.10+ Fix from $1,9502022-11-03 MEDIUM 5.3 CVE-2022-44622 In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive Teamcity 2022.10+ Fix from $1,6002022-11-03 MEDIUM 5.3 CVE-2022-40979 In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable Teamcity 2022.04.4+ Fix from $1,6002022-09-23 HIGH 7.8 CVE-2022-40978 The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking Intellij Idea 2022.2.2+ Fix from $1,9502022-09-19 MEDIUM 6.5 CVE-2022-38180 In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases Ktor 2.1.0+ Fix from $1,6002022-08-12 MEDIUM 6.1 CVE-2022-38179 JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack Ktor 2.1.0+ Fix from $1,6002022-08-12 MEDIUM 5.3 CVE-2022-38133 In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases Teamcity 2022.04.3+ Fix from $1,6002022-08-10 HIGH 7.8 CVE-2022-37396 In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution Rider 2022.2+ Fix from $1,9502022-08-03 HIGH 7.8 CVE-2022-37009 In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible Intellij Idea 2022.2+ Fix from $1,9502022-07-28 HIGH 8.8 CVE-2022-36322 In JetBrains TeamCity before 2022.04.2 build parameter injection was possible Teamcity 2022.04.2+ Fix from $1,9502022-07-20 MEDIUM 6.5 CVE-2022-36321 In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases Teamcity 2022.04.2+ Fix from $1,6002022-07-20 MEDIUM 5.3 CVE-2022-34894 In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services Hub 2022.2.14799+ Fix from $1,6002022-07-01 MEDIUM 6.1 CVE-2022-29927 In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible Teamcity 2022.04+ Fix from $1,6002022-05-12 MEDIUM 6.1 CVE-2022-29929 In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible Teamcity 2022.04+ Fix from $1,6002022-05-12 HIGH 7.7 CVE-2022-29814 In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible Intellij Idea 2022.1+ Fix from $1,9502022-04-28 HIGH 7.7 CVE-2022-29819 In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible Intellij Idea 2022.1+ Fix from $1,9502022-04-28 HIGH 7.7 CVE-2022-29821 In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible Pycharm 2022.1+ Fix from $1,9502022-04-28 HIGH 7.1 CVE-2022-29818 In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed Intellij Idea 2022.1+ Fix from $1,9502022-04-28