Teamcity
by Jetbrains
Source repositories
CVEs (277)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-39173 | Med | 0.35 | 5.4 | 0.00 | Jul 25, 2023 | In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access | ||
| CVE-2023-34225 | Med | 0.35 | 4.6 | 0.61 | May 31, 2023 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible | ||
| CVE-2023-34220 | Med | 0.35 | 4.6 | 0.61 | May 31, 2023 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible | ||
| CVE-2022-48428 | Med | 0.35 | 4.6 | 0.68 | Mar 27, 2023 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible | ||
| CVE-2022-48344 | Med | 0.35 | 5.4 | 0.00 | Feb 23, 2023 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. | ||
| CVE-2022-36322 | Med | 0.35 | 5.4 | 0.01 | Jul 20, 2022 | In JetBrains TeamCity before 2022.04.2 build parameter injection was possible | ||
| CVE-2022-24339 | Med | 0.35 | 5.4 | 0.00 | Feb 25, 2022 | JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. | ||
| CVE-2022-24336 | Med | 0.35 | 5.3 | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server. | ||
| CVE-2022-24334 | Med | 0.35 | 5.3 | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. | ||
| CVE-2022-24332 | Med | 0.35 | 5.3 | 0.01 | Feb 25, 2022 | In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | ||
| CVE-2021-43201 | Med | 0.35 | 5.3 | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. | ||
| CVE-2021-43199 | Med | 0.35 | 5.3 | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. | ||
| CVE-2021-43198 | Med | 0.35 | 5.4 | 0.00 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, stored XSS is possible. | ||
| CVE-2021-43195 | Med | 0.35 | 5.3 | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. | ||
| CVE-2021-43194 | Med | 0.35 | 5.3 | 0.01 | Nov 9, 2021 | In JetBrains TeamCity before 2021.1.2, user enumeration was possible. | ||
| CVE-2021-37547 | Med | 0.35 | 5.3 | 0.01 | Aug 6, 2021 | In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made. | ||
| CVE-2021-3315 | Med | 0.35 | 5.4 | 0.00 | May 11, 2021 | In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible. | ||
| CVE-2021-31908 | Med | 0.35 | 5.4 | 0.00 | May 11, 2021 | In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages. | ||
| CVE-2021-31907 | Med | 0.35 | 5.3 | 0.01 | May 11, 2021 | In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. | ||
| CVE-2021-25778 | Med | 0.35 | 5.3 | 0.01 | Feb 3, 2021 | In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. |
- risk 0.35cvss 5.4epss 0.00
In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
- risk 0.35cvss 4.6epss 0.61
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
- risk 0.35cvss 4.6epss 0.61
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
- risk 0.35cvss 4.6epss 0.68
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
- risk 0.35cvss 5.4epss 0.00
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
- risk 0.35cvss 5.4epss 0.01
In JetBrains TeamCity before 2022.04.2 build parameter injection was possible
- risk 0.35cvss 5.4epss 0.00
JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
- risk 0.35cvss 5.4epss 0.00
In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.
- risk 0.35cvss 5.4epss 0.00
In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.
- risk 0.35cvss 5.4epss 0.00
In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.
- risk 0.35cvss 5.3epss 0.01
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
Page 7 of 14