Jetbrains

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible

In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed

In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls…

In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible

In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases

Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.

Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter

In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log

In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test

In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata