CVEs (273)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token |
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab |
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup |
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test |
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page |
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration |
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload |
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute |
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata |
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure |
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows |
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload |
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition |
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files |
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content |
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership |
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint |
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms |