Jetbrains

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution

In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible

In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible

In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed

In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls…

In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible

In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases

Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.

Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter

In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible