Vulnerabilities

TI-2025-41745 CVE-2025-68166 · GHSA-7jmx-wp8v-fmfp

In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab

LOW 27

In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00198 Published 2025-12-16 Fixed in 2025.11 CWE-79

TI-2025-41744 CVE-2025-68165 · GHSA-q989-g7c9-6fc8

LOW 34

In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04207 Published 2025-12-16 Fixed in 2025.11 CWE-79

TI-2025-41743 CVE-2025-68164

LOW 13

In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00241 Published 2025-12-16 Fixed in 2025.11 CWE-203

TI-2025-41742 CVE-2025-68163 · GHSA-7r6f-cxwr-wpmj

LOW 21

In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00189 Published 2025-12-16 Fixed in 2025.11 CWE-79

TI-2025-41741 CVE-2025-68162

LOW 13

In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00211 Published 2025-12-16 Fixed in 2025.11 CWE-829