Total
257 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-35301 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 5.5 MEDIUM |
|
In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
|
|||||
| CVE-2024-35300 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 3.5 LOW |
|
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
|
|||||
| CVE-2024-36370 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible
|
|||||
| CVE-2024-35302 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 5.4 MEDIUM |
|
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
|
|||||
| CVE-2024-36362 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 6.5 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
|
|||||
| CVE-2024-36363 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible
|
|||||
| CVE-2024-36364 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 6.5 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
|
|||||
| CVE-2024-29880 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.2 MEDIUM |
|
In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process
|
|||||
| CVE-2024-36367 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
|
|||||
| CVE-2024-36368 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible
|
|||||
| CVE-2024-36369 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
|
|||||
| CVE-2024-28173 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 4.3 MEDIUM |
|
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
|
|||||
| CVE-2024-28174 | 1 Jetbrains | 1 Teamcity | 2024-12-16 | N/A | 5.8 MEDIUM |
|
In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly
|
|||||
| CVE-2024-41829 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 3.5 LOW |
|
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
|
|||||
| CVE-2024-41828 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 2.6 LOW |
|
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
|
|||||
| CVE-2024-41827 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 7.4 HIGH |
|
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
|
|||||
| CVE-2024-41826 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 3.5 LOW |
|
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
|
|||||
| CVE-2024-41825 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
|
|||||
| CVE-2024-41824 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 6.4 MEDIUM |
|
In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
|
|||||
| CVE-2024-39879 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 5.0 MEDIUM |
|
In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings
|
|||||
| CVE-2024-39878 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.1 MEDIUM |
|
In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection
|
|||||
| CVE-2024-31138 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
|
|||||
| CVE-2024-31137 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 6.8 MEDIUM |
|
In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
|
|||||
| CVE-2024-31135 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 6.1 MEDIUM |
|
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
|
|||||
| CVE-2024-24942 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 5.3 MEDIUM |
|
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
|
|||||
| CVE-2024-24938 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 5.3 MEDIUM |
|
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
|
|||||
| CVE-2024-24937 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
|
|||||
| CVE-2024-24936 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.3 MEDIUM |
|
In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
|
|||||
| CVE-2024-23917 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 9.8 CRITICAL |
|
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
|
|||||
| CVE-2023-50870 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.3 MEDIUM |
|
In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible
|
|||||
| CVE-2023-43566 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 3.5 LOW |
|
In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration
|
|||||
| CVE-2023-41250 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 3.5 LOW |
|
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
|
|||||
| CVE-2023-41249 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step
|
|||||
| CVE-2023-41248 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration
|
|||||
| CVE-2023-39175 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible
|
|||||
| CVE-2023-39174 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.3 MEDIUM |
|
In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers
|
|||||
| CVE-2023-39173 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 5.4 MEDIUM |
|
In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access
|
|||||
| CVE-2023-38067 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.3 MEDIUM |
|
In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log
|
|||||
| CVE-2023-38066 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
|
|||||
| CVE-2023-38065 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 4.6 MEDIUM |
|
In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible
|
|||||