Jetbrains

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.

In JetBrains Hub before 2021.1.13690, stored XSS is possible.

In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

In JetBrains TeamCity before 2020.2.3, XSS was possible.

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.

JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.

In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.

A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.

A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack

In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens

In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation

In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector

In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly

JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.

JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function

In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content