Teamcity
by Jetbrains
Source repositories
CVEs (277)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-46433 | Med | 0.32 | 4.9 | 0.01 | Apr 25, 2025 | In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible | ||
| CVE-2025-31140 | Med | 0.32 | 4.6 | 0.27 | Mar 27, 2025 | In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page | ||
| CVE-2024-47948 | Med | 0.32 | 4.9 | 0.01 | Oct 8, 2024 | In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups | ||
| CVE-2020-11938 | Med | 0.32 | 4.9 | 0.01 | Apr 22, 2020 | In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2. | ||
| CVE-2019-15035 | Med | 0.32 | 4.9 | 0.01 | Oct 1, 2019 | An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1. | ||
| CVE-2025-54534 | Med | 0.31 | 4.8 | 0.01 | Jul 28, 2025 | In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page | ||
| CVE-2025-52879 | Med | 0.31 | 4.8 | 0.01 | Jun 23, 2025 | In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible | ||
| CVE-2025-47853 | Med | 0.31 | 4.8 | 0.01 | May 20, 2025 | In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible | ||
| CVE-2025-47852 | Med | 0.31 | 4.8 | 0.01 | May 20, 2025 | In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible | ||
| CVE-2025-47851 | Med | 0.31 | 4.8 | 0.02 | May 20, 2025 | In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible | ||
| CVE-2023-34224 | Med | 0.31 | 4.8 | 0.00 | May 31, 2023 | In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible | ||
| CVE-2025-67741 | Med | 0.30 | 4.6 | 0.00 | Dec 11, 2025 | In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute | ||
| CVE-2025-26493 | Med | 0.30 | 4.6 | 0.00 | Feb 11, 2025 | In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab | ||
| CVE-2025-24459 | Med | 0.30 | 4.6 | 0.03 | Jan 21, 2025 | In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page | ||
| CVE-2024-56355 | Med | 0.30 | 4.6 | 0.01 | Dec 20, 2024 | In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS | ||
| CVE-2024-56352 | Med | 0.30 | 4.6 | 0.01 | Dec 20, 2024 | In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page | ||
| CVE-2024-43810 | Med | 0.30 | 4.6 | 0.00 | Aug 16, 2024 | In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin | ||
| CVE-2024-43807 | Med | 0.30 | 4.6 | 0.00 | Aug 16, 2024 | In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page | ||
| CVE-2024-41825 | Med | 0.30 | 4.6 | 0.00 | Jul 22, 2024 | In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab | ||
| CVE-2024-36374 | Med | 0.30 | 4.6 | 0.00 | May 29, 2024 | In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible |
- risk 0.32cvss 4.9epss 0.01
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
- risk 0.32cvss 4.6epss 0.27
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
- risk 0.32cvss 4.9epss 0.01
In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
- risk 0.32cvss 4.9epss 0.01
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.
- risk 0.32cvss 4.9epss 0.01
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
- risk 0.31cvss 4.8epss 0.01
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
- risk 0.31cvss 4.8epss 0.01
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
- risk 0.31cvss 4.8epss 0.01
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
- risk 0.31cvss 4.8epss 0.01
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
- risk 0.31cvss 4.8epss 0.02
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
- risk 0.31cvss 4.8epss 0.00
In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
- risk 0.30cvss 4.6epss 0.03
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
- risk 0.30cvss 4.6epss 0.01
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
- risk 0.30cvss 4.6epss 0.00
In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
Page 9 of 14