Jetbrains
jetbrains
602 CVEs • 38 products
Products (38)
Click to collapseToggle
Products (38)
Click to collapse
CVEs (602)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership |
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature |
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start |
In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |
In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference |
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint |
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms |
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page |
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration |
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies |
In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows |
In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions |
In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration |
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow |
In JetBrains YouTrack before 2025.2.86935,
2025.2.87167,
2025.3.87341,
2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions |
In JetBrains YouTrack before 2025.2.86069,
2024.3.85077,
2025.1.86199 email spoofing via an administrative API was possible |
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible |