Jetbrains
jetbrains
602 CVEs • 38 products
Products (38)
Click to collapseToggle
Products (38)
Click to collapse
CVEs (602)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file |
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. |
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. |
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. |
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. |
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible |
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
|
In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible |
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. |
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. |
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. |
In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system admi...Show more |
In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. |
In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. |
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. |
In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. |
In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. |