Teamcity
by Jetbrains
Source repositories
CVEs (267)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-24342 | 0.00 | — | 0.03 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. | |||
| CVE-2022-24341 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. | |||
| CVE-2022-24340 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. | |||
| CVE-2022-24339 | 0.00 | — | 0.00 | Feb 25, 2022 | JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. | |||
| CVE-2022-24338 | 0.00 | — | 0.01 | Feb 25, 2022 | JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. | |||
| CVE-2022-24337 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions. | |||
| CVE-2022-24336 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. | |||
| CVE-2022-24335 | 0.00 | — | 0.01 | Feb 25, 2022 | JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. | |||
| CVE-2022-24334 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. | |||
| CVE-2022-24333 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. | |||
| CVE-2022-24332 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | |||
| CVE-2022-24331 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. | |||
| CVE-2022-24330 | 0.00 | — | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. | |||
| CVE-2021-43202 | 0.00 | — | 0.01 | Nov 30, 2021 | In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. | |||
| CVE-2021-43194 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, user enumeration was possible. | |||
| CVE-2021-43193 | 0.00 | — | 0.02 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. | |||
| CVE-2021-43196 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. | |||
| CVE-2021-43195 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. | |||
| CVE-2021-43197 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. | |||
| CVE-2021-43199 | 0.00 | — | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. |
- CVE-2022-24342Feb 25, 2022risk 0.00cvss —epss 0.03
In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
- CVE-2022-24341Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
- CVE-2022-24340Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
- CVE-2022-24339Feb 25, 2022risk 0.00cvss —epss 0.00
JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
- CVE-2022-24338Feb 25, 2022risk 0.00cvss —epss 0.01
JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
- CVE-2022-24337Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
- CVE-2022-24336Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
- CVE-2022-24335Feb 25, 2022risk 0.00cvss —epss 0.01
JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.
- CVE-2022-24334Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
- CVE-2022-24333Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
- CVE-2022-24332Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
- CVE-2022-24331Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
- CVE-2022-24330Feb 25, 2022risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.
- CVE-2021-43202Nov 30, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
- CVE-2021-43194Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
- CVE-2021-43193Nov 9, 2021risk 0.00cvss —epss 0.02
In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
- CVE-2021-43196Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
- CVE-2021-43195Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
- CVE-2021-43197Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
- CVE-2021-43199Nov 9, 2021risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
Page 10 of 14