Jetbrains

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.

Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible

In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs

In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed

In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible

In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.

In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.

In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.

In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.

In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page

In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.

An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible