Priority CRITICAL 100KEV
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.94887 · Published 2026-07-27 · Fixed in 2026.1.3, 2025.11.7 CWE-502
Priority CRITICAL 100KEV
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99938 · Published 2024-03-04 · Fixed in 2023.11.4 CWE-288
Priority CRITICAL 100KEV
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99987 · Published 2023-09-19 · Fixed in 2023.05.4 CWE-288
Priority CRITICAL 89KEV
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.99991 · Published 2024-03-04 · Fixed in 2023.11.4 CWE-23
Priority HIGH 82
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.54009 · Published 2024-02-06 · Fixed in 2023.11.3 CWE-288
Priority HIGH 75
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4,…
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.04883 · Published 2024-06-10 · Fixed in 2023.1.7, 2023.2.7 +19 CWE-522
Priority HIGH 68
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00615 · Published 2023-06-29 · Fixed in 9.0.2 CWE-425
Priority HIGH 65
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.32685 · Published 2026-05-29 · Fixed in 2026.1 CWE-88
Priority MEDIUM 63
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.63034 · Published 2025-04-25 · Fixed in 2025.03.1 CWE-79
Priority MEDIUM 63
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.74689 · Published 2024-03-28 · Fixed in 2024.03 CWE-79
Priority MEDIUM 61
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.6796 · Published 2023-03-27 · Fixed in 2022.10.3 CWE-79
Priority MEDIUM 61
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.59462 · Published 2023-02-23 · Fixed in 2022.10.2 CWE-79
Priority MEDIUM 60
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.55527 · Published 2023-08-25 · Fixed in 2023.05.3 CWE-79
Priority MEDIUM 59
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.6072 · Published 2023-05-31 · Fixed in 2023.05 CWE-79
Priority MEDIUM 59
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.61433 · Published 2023-05-31 · Fixed in 2023.05 CWE-79
Priority MEDIUM 57
In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.32121 · Published 2024-10-08 · Fixed in 2024.07.3 CWE-23
Priority MEDIUM 57
An issue was discovered in JetBrains TeamCity 2018.2.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.13052 · Published 2019-10-01 · No fix listed CWE-22
Priority MEDIUM 54
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.31977 · Published 2024-02-06 · Fixed in 2023.11.3 CWE-23
Priority MEDIUM 51
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.38598 · Published 2025-06-23 · Fixed in 2025.03.3 CWE-79
Priority MEDIUM 50
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00566 · Published 2026-09-07 · Fixed in 2026.2.52442 CWE-306
Priority MEDIUM 50
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00606 · Published 2026-09-07 · Fixed in 2025.3.161254,
2026.1.14042 CWE-290
Priority MEDIUM 50
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00611 · Published 2026-07-14 · Fixed in 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 CWE-306
Priority MEDIUM 50
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00611 · Published 2026-06-19 · Fixed in 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 CWE-306
Priority MEDIUM 50
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.28035 · Published 2025-03-27 · Fixed in 2025.03 CWE-79
Priority MEDIUM 50
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00593 · Published 2023-05-31 · Fixed in 2023.05 CWE-863
Load more
THREATIST.IORead the docs