Filtered by vendor Jetbrains
Subscribe
Search
Total
249 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-25763 | 1 Jetbrains | 1 Ktor | 2021-02-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. | |||||
| CVE-2021-25769 | 1 Jetbrains | 1 Youtrack | 2021-02-05 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments. | |||||
| CVE-2021-25767 | 1 Jetbrains | 1 Youtrack | 2021-02-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution. | |||||
| CVE-2021-25774 | 1 Jetbrains | 1 Teamcity | 2021-02-05 | 4.0 MEDIUM | 4.3 MEDIUM |
| In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. | |||||
| CVE-2021-25770 | 1 Jetbrains | 1 Youtrack | 2021-02-05 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. | |||||
| CVE-2021-25756 | 1 Jetbrains | 1 Intellij Idea | 2021-02-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. | |||||
| CVE-2021-25757 | 1 Jetbrains | 1 Hub | 2021-02-04 | 5.8 MEDIUM | 6.1 MEDIUM |
| In JetBrains Hub before 2020.1.12629, an open redirect was possible. | |||||
| CVE-2021-25760 | 1 Jetbrains | 1 Hub | 2021-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. | |||||
| CVE-2021-25765 | 1 Jetbrains | 1 Youtrack | 2021-02-04 | 6.8 MEDIUM | 8.8 HIGH |
| In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. | |||||
| CVE-2021-25772 | 1 Jetbrains | 1 Teamcity | 2021-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration. | |||||
| CVE-2021-25776 | 1 Jetbrains | 1 Teamcity | 2021-02-04 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. | |||||
| CVE-2021-25777 | 1 Jetbrains | 1 Teamcity | 2021-02-04 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. | |||||
| CVE-2021-25771 | 1 Jetbrains | 1 Youtrack | 2021-02-04 | 5.0 MEDIUM | 4.3 MEDIUM |
| In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed. | |||||
| CVE-2021-25773 | 1 Jetbrains | 1 Teamcity | 2021-02-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. | |||||
| CVE-2019-12157 | 1 Jetbrains | 2 Teamcity, Upsource | 2021-01-26 | 10.0 HIGH | 9.8 CRITICAL |
| In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. | |||||
| CVE-2020-27629 | 1 Jetbrains | 1 Teamcity | 2020-12-01 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts. | |||||
| CVE-2020-26129 | 1 Jetbrains | 1 Ktor | 2020-12-01 | 6.4 MEDIUM | 6.5 MEDIUM |
| In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. | |||||
| CVE-2020-27627 | 1 Jetbrains | 1 Teamcity | 2020-12-01 | 5.8 MEDIUM | 6.1 MEDIUM |
| JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. | |||||
| CVE-2020-27623 | 1 Jetbrains | 1 Ideavim | 2020-11-30 | 5.0 MEDIUM | 7.5 HIGH |
| JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances. | |||||
| CVE-2020-27622 | 1 Jetbrains | 1 Intellij Idea | 2020-11-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. | |||||
| CVE-2020-27628 | 1 Jetbrains | 1 Teamcity | 2020-11-23 | 4.0 MEDIUM | 4.3 MEDIUM |
| In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. | |||||
| CVE-2020-25207 | 1 Jetbrains | 1 Toolbox | 2020-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. | |||||
| CVE-2020-25013 | 1 Jetbrains | 1 Toolbox | 2020-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. | |||||
| CVE-2020-27625 | 1 Jetbrains | 1 Youtrack | 2020-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. | |||||
| CVE-2020-27624 | 1 Jetbrains | 1 Youtrack | 2020-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. | |||||
| CVE-2020-27626 | 1 Jetbrains | 1 Youtrack | 2020-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. | |||||
| CVE-2020-15822 | 1 Jetbrains | 1 Youtrack | 2020-10-22 | 7.5 HIGH | 7.3 HIGH |
| In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped. | |||||
| CVE-2019-18368 | 1 Jetbrains | 1 Toolbox | 2020-08-24 | 7.5 HIGH | 7.3 HIGH |
| In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible. | |||||
| CVE-2019-9873 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8. | |||||
| CVE-2019-9872 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 4.3 MEDIUM | 8.1 HIGH |
| In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and configured to synchronize IDE settings using a public repository, these credentials were published to this repository. The issue has been fixed in the following versions: 2019.1, 2018.3.5, 2018.2.8, and 2018.1.8. | |||||
| CVE-2019-9823 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 5.0 MEDIUM | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext record of the server credentials in the IDE configuration files. The issue has been fixed in the following versions: 2018.3.5, 2018.2.8, 2018.1.8. | |||||
| CVE-2019-19389 | 1 Jetbrains | 1 Ktor | 2020-08-24 | 3.5 LOW | 5.4 MEDIUM |
| JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting. | |||||
| CVE-2019-18361 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 4.6 MEDIUM | 5.3 MEDIUM |
| JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution. | |||||
| CVE-2019-15039 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 6.8 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1. | |||||
| CVE-2019-15038 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1. | |||||
| CVE-2019-14958 | 1 Jetbrains | 1 Pycharm | 2020-08-24 | 5.0 MEDIUM | 7.5 HIGH |
| JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a remote invocation of an OOM error message because of Uncontrolled Memory Allocation. | |||||
| CVE-2019-12867 | 1 Jetbrains | 1 Youtrack | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||||
| CVE-2019-12866 | 1 Jetbrains | 1 Youtrack | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | |||||
| CVE-2019-12847 | 1 Jetbrains | 1 Hub | 2020-08-24 | 4.0 MEDIUM | 7.2 HIGH |
| In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period. | |||||
| CVE-2019-12846 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 4.0 MEDIUM | 4.3 MEDIUM |
| A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2. | |||||
| CVE-2019-12845 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 5.0 MEDIUM | 5.3 MEDIUM |
| The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3. | |||||
| CVE-2019-12844 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3. | |||||
| CVE-2019-12843 | 1 Jetbrains | 1 Teamcity | 2020-08-24 | 4.3 MEDIUM | 6.1 MEDIUM |
| A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3. | |||||
| CVE-2019-12736 | 1 Jetbrains | 1 Ktor | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. | |||||
| CVE-2019-10104 | 1 Jetbrains | 1 Intellij Idea | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7. | |||||
| CVE-2019-10100 | 1 Jetbrains | 1 Youtrack Integration | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely. | |||||
| CVE-2020-15823 | 1 Jetbrains | 1 Youtrack | 2020-08-10 | 5.0 MEDIUM | 7.5 HIGH |
| JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component. | |||||
| CVE-2020-15819 | 1 Jetbrains | 1 Youtrack | 2020-08-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports. | |||||
| CVE-2020-15821 | 1 Jetbrains | 1 Youtrack | 2020-08-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft. | |||||
| CVE-2020-15827 | 1 Jetbrains | 1 Toolbox | 2020-08-10 | 5.0 MEDIUM | 7.5 HIGH |
| In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file. | |||||