Filtered by vendor Jetbrains
Subscribe
Search
Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-51655 | 1 Jetbrains | 1 Intellij Idea | 2023-12-29 | N/A | 9.8 CRITICAL |
| In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration | |||||
| CVE-2022-24442 | 1 Jetbrains | 1 Youtrack | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | |||||
| CVE-2022-24331 | 1 Jetbrains | 1 Teamcity | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. | |||||
| CVE-2022-25262 | 1 Jetbrains | 1 Hub | 2023-08-08 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | |||||
| CVE-2021-43183 | 1 Jetbrains | 1 Hub | 2022-07-12 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. | |||||
| CVE-2021-43202 | 1 Jetbrains | 1 Teamcity | 2021-12-01 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. | |||||
| CVE-2021-43185 | 1 Jetbrains | 1 Youtrack | 2021-11-12 | 7.5 HIGH | 9.8 CRITICAL |
| JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. | |||||
| CVE-2021-43193 | 1 Jetbrains | 1 Teamcity | 2021-11-10 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. | |||||
| CVE-2021-43200 | 1 Jetbrains | 1 Teamcity | 2021-11-09 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. | |||||
| CVE-2021-37544 | 1 Jetbrains | 1 Teamcity | 2021-08-12 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. | |||||
| CVE-2021-36209 | 1 Jetbrains | 1 Hub | 2021-08-12 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. | |||||
| CVE-2021-37549 | 1 Jetbrains | 1 Youtrack | 2021-08-12 | 6.4 MEDIUM | 9.1 CRITICAL |
| In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. | |||||
| CVE-2019-9186 | 1 Jetbrains | 1 Intellij Idea | 2021-07-21 | 7.5 HIGH | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote attackers to execute code when the configuration is running, because a JMX server listens on all interfaces (instead of listening on only the localhost interface). This issue has been fixed in the following versions: 2019.1, 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7. | |||||
| CVE-2021-31897 | 1 Jetbrains | 1 Webstorm | 2021-05-19 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. | |||||
| CVE-2021-31914 | 2 Jetbrains, Microsoft | 2 Teamcity, Windows | 2021-05-17 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. | |||||
| CVE-2021-31915 | 1 Jetbrains | 1 Teamcity | 2021-05-17 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. | |||||
| CVE-2021-31909 | 1 Jetbrains | 1 Teamcity | 2021-05-14 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. | |||||
| CVE-2021-25770 | 1 Jetbrains | 1 Youtrack | 2021-02-05 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. | |||||
| CVE-2019-12157 | 1 Jetbrains | 2 Teamcity, Upsource | 2021-01-26 | 10.0 HIGH | 9.8 CRITICAL |
| In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. | |||||
| CVE-2020-25207 | 1 Jetbrains | 1 Toolbox | 2020-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. | |||||
| CVE-2019-10104 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7. | |||||
| CVE-2019-15039 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 6.8 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1. | |||||
| CVE-2019-12867 | 1 Jetbrains | 1 Youtrack | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||||
| CVE-2019-12866 | 1 Jetbrains | 1 Youtrack | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||||
| CVE-2019-12736 | 1 Jetbrains | 1 Ktor | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. | |||||
| CVE-2019-10100 | 1 Jetbrains | 1 Youtrack Integration | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely. | |||||
| CVE-2019-9873 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8. | |||||
| CVE-2019-9823 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8. | |||||
| CVE-2020-11690 | 1 Jetbrains | 1 Intellij Idea | 2020-04-29 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. | |||||
| CVE-2020-11796 | 1 Jetbrains | 1 Space | 2020-04-29 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains Space through 2020-04-22, the password authentication implementation was insecure. | |||||
| CVE-2019-18364 | 1 Jetbrains | 1 Teamcity | 2019-11-01 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. | |||||
| CVE-2019-12852 | 1 Jetbrains | 1 Youtrack | 2019-07-10 | 7.5 HIGH | 9.8 CRITICAL |
| An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. | |||||
| CVE-2019-12850 | 1 Jetbrains | 1 Youtrack | 2019-07-10 | 7.5 HIGH | 9.8 CRITICAL |
| A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. | |||||