CVEs (283)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains TeamCity before 2026.1,
2025.11.5 reflected XSS was possible on the repository download page |
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters |
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings |
In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible |
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible |
In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access |
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk |
In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations |
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow |
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page |
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token |
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab |
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup |
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test |
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page |
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration |
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload |
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute |
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata |
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure |