| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority while details are being clarified. A corrected record will be published once verification is complete. |
| In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible |
| In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible |
| In JetBrains IDE Services before 2025.5.0.1086,
2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves |
| In JetBrains YouTrack before 2025.2.86069,
2024.3.85077,
2025.1.86199 email spoofing via an administrative API was possible |
| In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible |
| In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
| In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session |
| In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
| In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
| In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning |
| In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |
| In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature |
| In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition |
| In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload |
| In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows |
| In JetBrains Junie before 252.284.66,
251.284.66,
243.284.66,
252.284.61,
251.284.61,
243.284.61,
252.284.50,
252.284.54,
251.284.54,
251.284.50,
243.284.54,
243.284.50 code execution was possible due to improper command validation |
| In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation |
| In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files |
| In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content |