Browse CVEs

HIGH 8.1 CVE-2024-36376 In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions Teamcity 2024.03.2+ Fix from $1,9502024-05-29 HIGH 8.1 CVE-2024-36377 In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions Teamcity 2024.03.2+ Fix from $1,9502024-05-29 HIGH 7.5 CVE-2024-36378 In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens Teamcity 2024.03.2+ Fix from $1,9502024-05-29 MEDIUM 5.3 CVE-2024-36375 In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed Teamcity 2024.03.2+ Fix from $1,6002024-05-29 MEDIUM 6.1 CVE-2024-36372 In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible Teamcity 2023.05.6+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36370 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36371 In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible Teamcity 2023.05.6 / 2023.11.5+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36373 In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible Teamcity 2024.03.2+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36374 In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible Teamcity 2024.03.2+ Fix from $1,6002024-05-29 MEDIUM 6.1 CVE-2024-36366 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 6.1 CVE-2024-36367 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36368 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36369 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 HIGH 8.1 CVE-2024-36365 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,9502024-05-29 MEDIUM 6.5 CVE-2024-36362 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 6.5 CVE-2024-36364 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build fe… Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 5.4 CVE-2024-36363 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible Teamcity 2022.04.7 / 2022.10.6+ Fix from $1,6002024-05-29 MEDIUM 6.1 CVE-2024-35302 In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible Teamcity 2023.11+ Fix from $1,6002024-05-16 HIGH 7.5 CVE-2024-35299 In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation Youtrack 2024.1.29548+ Fix from $1,9502024-05-16 MEDIUM 6.1 CVE-2024-35300 In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible Teamcity Mitigation only Fix from $1,6002024-05-16 MEDIUM 5.5 CVE-2024-35301 In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token Teamcity 2024.03.1+ Fix from $1,6002024-05-16 HIGH 8.1 CVE-2024-31139 In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector Teamcity 2024.03+ Fix from $1,9502024-03-28 HIGH 7.4 CVE-2024-31136 In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter Teamcity 2024.03+ Fix from $1,9502024-03-28 MEDIUM 6.1 CVE-2024-31135 In JetBrains TeamCity before 2024.03 open redirect was possible on the login page Teamcity 2024.03+ Fix from $1,6002024-03-28 MEDIUM 6.1 CVE-2024-31137 In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration Teamcity 2024.03+ Fix from $1,6002024-03-28 MEDIUM 5.4 CVE-2024-31138EPSS 74% In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings Teamcity 2024.03+ Fix from $1,6002024-03-28 MEDIUM 6.5 CVE-2024-31134 In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was dis… Teamcity 2024.03+ Fix from $1,6002024-03-28 HIGH 7.8 CVE-2024-29880 In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process Teamcity 2023.11+ Fix from $1,9502024-03-21 MEDIUM 6.5 CVE-2024-28229 In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles Youtrack 2024.1.25893+ Fix from $1,6002024-03-07 MEDIUM 6.5 CVE-2024-28230 In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions Youtrack 2024.1.25893+ Fix from $1,6002024-03-07