Jetbrains

In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.

In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.

In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.

In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.

In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.

JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.

In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.

In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

JetBrains Space through 2020-04-22 allows stored XSS in Chats.

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.

Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible

In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs

In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location