Jetbrains

JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.

In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.

In JetBrains TeamCity before 2021.1.2, user enumeration was possible.

In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.

JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.

In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.

In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.

In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.

In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.

In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.

In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.

In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.

JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.

In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.

In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

JetBrains Space through 2020-04-22 allows stored XSS in Chats.

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.