JetBrains TeamCity

• CVE-2025-54538 Medium 5.5 In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command 0.3%
• CVE-2025-54537 Medium 5.5 In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots 0.3%
• CVE-2025-54536 Medium 5.4 In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint 0.2%
• CVE-2025-54535 Medium 5.8 In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms 0.2%
• CVE-2025-54534 Medium 4.8 In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page 0.9%
• CVE-2025-54533 Medium 4.3 In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration 0.3%
• CVE-2025-54532 Medium 4.3 In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies 0.3%
• CVE-2025-54531 High 7.7 In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows 0.3%
• CVE-2025-54530 High 7.5 In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions 0.2%
• CVE-2025-54529 Low 3.7 In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration 0.1%
• CVE-2025-54528 Medium 5.4 In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow 0.2%
• CVE-2025-52879 Medium 4.8 In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible 1.2%
• CVE-2025-52878 Medium 4.3 In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions 0.4%
• CVE-2025-52877 Medium 4.8 In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible 37.0%
• CVE-2025-52876 Medium 5.4 In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible 38.6%
• CVE-2025-52875 Medium 5.4 In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible 1.0%
• CVE-2025-47854 Medium 4.3 In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page 0.3%
• CVE-2025-47853 Medium 4.8 In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible 0.8%
• CVE-2025-47852 Medium 4.8 In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible 0.8%
• CVE-2025-47851 Medium 4.8 In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible 2.8%
• CVE-2025-46618 Low 3.5 In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab 63.0%
• CVE-2025-46433 Medium 4.9 In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible 0.6%
• CVE-2025-46432 Medium 4.3 In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs 1.0%
• CVE-2025-31141 Low 2.7 In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page 0.4%
• CVE-2025-31140 Medium 4.6 In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page 28.0%
• CVE-2025-31139 Medium 4.3 In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log 1.0%
• CVE-2025-26492 High 7.7 In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources 0.4%
• CVE-2025-26493 Medium 4.6 In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab 0.4%
• CVE-2025-24461 Medium 6.5 In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint 0.3%
• CVE-2025-24460 Medium 4.3 In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool 0.3%
• CVE-2025-24459 Medium 4.6 In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page 2.9%
• CVE-2024-56356 Medium 5.9 In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack 0.2%
• CVE-2024-56355 Medium 4.6 In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS 0.8%
• CVE-2024-56354 Medium 5.5 In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission 0.3%
• CVE-2024-56353 Medium 5.5 In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies 0.3%
• CVE-2024-56352 Medium 4.6 In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page 0.8%
• CVE-2024-56351 Medium 6.3 In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles 0.3%
• CVE-2024-56350 Medium 4.3 In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects 0.3%
• CVE-2024-56349 Medium 5.3 In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs 0.3%
• CVE-2024-56348 Medium 4.3 In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents 0.3%
• CVE-2024-47951 Low 3.5 In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings 1.4%
• CVE-2024-47950 Low 3.5 In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings 1.4%
• CVE-2024-47949 Medium 4.9 In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location 23.5%
• CVE-2024-47948 Medium 4.9 In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups 0.5%
• CVE-2024-47161 Medium 4.3 In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API 0.3%
• CVE-2024-43810 Medium 4.6 In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin 0.3%
• CVE-2024-43809 Low 3.5 In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page 0.3%
• CVE-2024-43808 Low 3.7 In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin 0.2%
• CVE-2024-43807 Medium 4.6 In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page 0.3%
• CVE-2024-43114 High 7.5 In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions 0.2%