Browse CVEs

MEDIUM 5.3 CVE-2024-28228 In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible Youtrack 2024.1.25893+ Fix from $1,6002024-03-07 MEDIUM 5.8 CVE-2024-28174 In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly Teamcity 2023.11.4+ Fix from $1,6002024-03-06 CRITICAL 9.8 CVE-2024-27198 KEVEPSS 100% In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible Teamcity 2023.11.4+ Fix from $2,3002024-03-04 HIGH 7.3 CVE-2024-27199 KEVEPSS 100% In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible Teamcity 2023.11.4+ Fix from $1,9502024-03-04 MEDIUM 5.5 CVE-2024-24943 In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image Toolbox 2.2+ Fix from $1,6002024-02-06 MEDIUM 5.3 CVE-2024-24941 In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL Intellij Idea 2023.3.3+ Fix from $1,6002024-02-06 MEDIUM 5.3 CVE-2024-24942EPSS 32% In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives Teamcity 2023.11.3+ Fix from $1,6002024-02-06 MEDIUM 5.3 CVE-2024-24938 In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation Teamcity 2023.11.2+ Fix from $1,6002024-02-06 MEDIUM 5.3 CVE-2024-24939 In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible Rider 2023.3.3+ Fix from $1,6002024-02-06 CRITICAL 9.8 CVE-2024-23917EPSS 54% In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible Teamcity 2023.11.3+ Fix from $2,3002024-02-06 MEDIUM 5.4 CVE-2024-24937 In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible Teamcity 2023.11.2+ Fix from $1,6002024-02-06 MEDIUM 5.3 CVE-2024-24936 In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed Teamcity 2023.11.2+ Fix from $1,6002024-02-06 MEDIUM 5.4 CVE-2024-22370 In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible Youtrack 2023.3.22666+ Fix from $1,6002024-01-09 CRITICAL 9.8 CVE-2023-51655 In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the p… Intellij Idea 2023.3.2+ Fix from $2,3002023-12-21 HIGH 8.8 CVE-2023-50870 In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible Teamcity 2023.11.1+ Fix from $1,9502023-12-15 CRITICAL 9.8 CVE-2023-45612 In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE Ktor 2.3.5+ Fix from $2,3002023-10-09 CRITICAL 9.1 CVE-2023-45613 In JetBrains Ktor before 2.3.5 server certificates were not verified Ktor 2.3.5+ Fix from $2,3002023-10-09 CRITICAL 9.8 CVE-2023-42793 KEVEPSS 100% In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible Teamcity 2023.05.4+ Fix from $2,3002023-09-19 MEDIUM 5.4 CVE-2023-43566 In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration Teamcity 2023.05.4+ Fix from $1,6002023-09-19 MEDIUM 6.1 CVE-2023-41249EPSS 53% In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step Teamcity 2023.05.3+ Fix from $1,6002023-08-25 MEDIUM 6.1 CVE-2023-41250 In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration Teamcity 2023.05.3+ Fix from $1,6002023-08-25 MEDIUM 5.4 CVE-2023-41248 In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration Teamcity 2023.05.3+ Fix from $1,6002023-08-25 HIGH 7.8 CVE-2023-39261 In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions Intellij Idea 2023.2+ Fix from $1,9502023-07-26 HIGH 8.8 CVE-2023-39173 In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access Teamcity 2023.05.2+ Fix from $1,9502023-07-25 HIGH 7.5 CVE-2023-39174 In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers Teamcity 2023.05.2+ Fix from $1,9502023-07-25 MEDIUM 6.1 CVE-2023-39175 In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible Teamcity 2023.05.2+ Fix from $1,6002023-07-25 HIGH 7.3 CVE-2023-38068 In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms Youtrack 2023.1.16597+ Fix from $1,9502023-07-12 MEDIUM 6.5 CVE-2023-38062 In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations Teamcity 2023.05.1+ Fix from $1,6002023-07-12 MEDIUM 6.5 CVE-2023-38064 In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log Teamcity 2023.05.1+ Fix from $1,6002023-07-12 MEDIUM 6.5 CVE-2023-38067 In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log Teamcity 2023.05.1+ Fix from $1,6002023-07-12