Jetbrains

In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool

In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects

In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector

In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services

In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project

In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles

In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers

In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log

In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log

In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations

In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API

In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.

In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.

In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.

In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.

In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.

A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.

In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition

In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition

In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin

In JetBrains GoLand before 2025.1 an XXE during debugging was possible

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page

In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection

In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases

In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution

In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab

In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible