JetBrains IntelliJ IDEA

• CVE-2024-37051 Critical 9.3 GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 4.9%
• CVE-2024-24941 Medium 6.1 In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL 0.3%
• CVE-2024-24940 Low 2.8 In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives 0.3%
• CVE-2023-51655 Medium 6.3 In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration 0.3%
• CVE-2023-39261 Medium 5.2 In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions 0.3%
• CVE-2023-38069 Low 3.3 In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases 0.2%
• CVE-2022-48433 Medium 6.1 In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. 0.6%
• CVE-2022-48432 Medium 5.2 In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. 0.2%
• CVE-2022-48431 Medium 4.5 In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. 0.1%
• CVE-2022-48430 Medium 5.5 In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. 0.3%
• CVE-2022-47896 Medium 5.0 In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. 0.3%
• CVE-2022-47895 Medium 4.7 In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. 0.2%
• CVE-2022-46828 Medium 5.2 In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. 0.3%
• CVE-2022-46827 Low 3.9 In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. 0.2%
• CVE-2022-46826 Medium 6.2 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. 0.2%
• CVE-2022-46825 Medium 4.0 In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. 0.1%
• CVE-2022-46824 Medium 5.6 In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. 0.2%
• CVE-2022-40978 High 7.5 The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking 0.3%
• CVE-2022-37010 Low 3.6 In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed 0.2%
• CVE-2022-37009 Low 3.9 In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible 0.3%
• CVE-2022-29819 Medium 6.9 In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible 0.2%
• CVE-2022-29818 Low 3.9 In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed 0.1%
• CVE-2022-29817 Low 3.9 In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible 0.4%
• CVE-2022-29816 Low 2.8 In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible 0.3%
• CVE-2022-29815 Medium 6.9 In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible 0.2%
• CVE-2022-29814 Medium 6.9 In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible 0.2%
• CVE-2022-29813 Medium 6.9 In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible 0.2%
• CVE-2022-29812 Low 2.3 In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient 0.2%
• CVE-2022-28651 High 8.4 In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields 0.3%