Teamcity
by Jetbrains
Source repositories
CVEs (267)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-41826 | 0.00 | — | 0.00 | Jul 22, 2024 | In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page | |||
| CVE-2024-41824 | 0.00 | — | 0.00 | Jul 22, 2024 | In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases | |||
| CVE-2024-39879 | 0.00 | — | 0.00 | Jul 1, 2024 | In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings | |||
| CVE-2024-39878 | 0.00 | — | 0.00 | Jul 1, 2024 | In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection | |||
| CVE-2024-36470 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases | |||
| CVE-2024-36378 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens | |||
| CVE-2024-36377 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions | |||
| CVE-2024-36376 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions | |||
| CVE-2024-36375 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed | |||
| CVE-2024-36368 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible | |||
| CVE-2024-36365 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent | |||
| CVE-2024-36364 | 0.00 | — | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible | |||
| CVE-2024-36362 | 0.00 | — | 0.01 | May 29, 2024 | In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible | |||
| CVE-2024-35302 | 0.00 | — | 0.00 | May 16, 2024 | In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible | |||
| CVE-2024-35301 | 0.00 | — | 0.00 | May 16, 2024 | In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token | |||
| CVE-2024-35300 | 0.00 | — | 0.00 | May 16, 2024 | In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible | |||
| CVE-2024-31140 | 0.00 | — | 0.00 | Mar 28, 2024 | In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools | |||
| CVE-2024-31139 | 0.00 | — | 0.00 | Mar 28, 2024 | In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector | |||
| CVE-2024-31138 | 0.00 | — | 0.74 | Mar 28, 2024 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings | |||
| CVE-2024-31137 | 0.00 | — | 0.00 | Mar 28, 2024 | In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration |
- CVE-2024-41826Jul 22, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
- CVE-2024-41824Jul 22, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
- CVE-2024-39879Jul 1, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings
- CVE-2024-39878Jul 1, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection
- CVE-2024-36470May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases
- CVE-2024-36378May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens
- CVE-2024-36377May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions
- CVE-2024-36376May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions
- CVE-2024-36375May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed
- CVE-2024-36368May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible
- CVE-2024-36365May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
- CVE-2024-36364May 29, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
- CVE-2024-36362May 29, 2024risk 0.00cvss —epss 0.01
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
- CVE-2024-35302May 16, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
- CVE-2024-35301May 16, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
- CVE-2024-35300May 16, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
- CVE-2024-31140Mar 28, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
- CVE-2024-31139Mar 28, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
- CVE-2024-31138Mar 28, 2024risk 0.00cvss —epss 0.74
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
- CVE-2024-31137Mar 28, 2024risk 0.00cvss —epss 0.00
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
Page 6 of 14