Teamcity

CVEs (280)

• CVE-2024-27198CriKEVMar 4, 2024
  Jetbrains

  Teamcity
  risk 0.93cvss 9.8epss 1.00

  In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

• CVE-2023-42793CriKEVSep 19, 2023
  Jetbrains

  Teamcity
  risk 0.93cvss 9.8epss 1.00

  In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

• CVE-2026-63077CriKEVJul 27, 2026
  Jetbrains

  Teamcity
  risk 0.76cvss 9.8epss 0.90

  In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

• CVE-2024-27199HigKEVMar 4, 2024
  Jetbrains

  Teamcity
  risk 0.73cvss 7.3epss 1.00

  In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

• CVE-2024-23917CriFeb 6, 2024
  Jetbrains

  Teamcity
  risk 0.68cvss 9.8epss 0.54

  In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

• CVE-2019-15039CriOct 1, 2019
  Jetbrains

  Teamcity
  risk 0.68cvss 9.8epss 0.13

  An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.

• CVE-2022-25263CriFeb 25, 2022
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.02

  JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

• CVE-2022-24340CriFeb 25, 2022
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.01

  In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

• CVE-2022-24331CriFeb 25, 2022
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.01

  In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.

• CVE-2021-43202CriNov 30, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.01

  In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.

• CVE-2021-43200CriNov 9, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.01

  In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

• CVE-2021-43193CriNov 9, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.02

  In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.

• CVE-2021-37544CriAug 6, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.01

  In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.

• CVE-2021-31915CriMay 11, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.03

  In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

• CVE-2021-31914CriMay 11, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.02

  In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

• CVE-2021-31909CriMay 11, 2021
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.03

  In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

• CVE-2019-18364CriOct 31, 2019
  Jetbrains

  Teamcity
  risk 0.64cvss 9.8epss 0.03

  In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

• CVE-2019-12157CriOct 2, 2019
  Jetbrains

  Upsource
  risk 0.64cvss 9.8epss 0.02

  In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.

• CVE-2023-34218CriMay 31, 2023
  Jetbrains

  Teamcity
  risk 0.59cvss 9.1epss 0.01

  In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

• CVE-2026-100254HigSep 30, 2026
  Jetbrains

  Teamcity
  risk 0.57cvss 8.8epss 0.01

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings