CVEs (283)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible |
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible |
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page |
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible |
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible |
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible |
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible |
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page |
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page |
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log |
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab |
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources |
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint |
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool |
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page |
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS |
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission |