JetBrains TeamCity

• CVE-2024-41829 Low 3.5 In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection 0.3%
• CVE-2024-41828 Low 2.6 In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time 0.3%
• CVE-2024-41827 High 7.4 In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration 0.4%
• CVE-2024-41826 Low 3.5 In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page 0.3%
• CVE-2024-41825 Medium 4.6 In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab 0.3%
• CVE-2024-41824 Medium 6.4 In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases 0.3%
• CVE-2024-39879 Medium 5.0 In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings 0.3%
• CVE-2024-39878 Medium 4.1 In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection 0.3%
• CVE-2024-36470 High 8.1 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases 0.5%
• CVE-2024-36378 Medium 5.9 In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens 0.4%
• CVE-2024-36377 Medium 6.5 In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions 0.3%
• CVE-2024-36376 Medium 6.5 In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions 0.3%
• CVE-2024-36375 Medium 5.3 In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed 0.3%
• CVE-2024-36374 Medium 4.6 In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible 0.3%
• CVE-2024-36373 Medium 4.6 In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible 0.3%
• CVE-2024-36372 Medium 4.6 In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible 0.3%
• CVE-2024-36371 Medium 4.6 In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible 0.3%
• CVE-2024-36370 Medium 4.6 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible 0.3%
• CVE-2024-36369 Medium 4.6 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible 0.3%
• CVE-2024-36368 Medium 4.6 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible 0.3%
• CVE-2024-36367 Medium 4.6 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible 0.3%
• CVE-2024-36366 Medium 5.4 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations 0.3%
• CVE-2024-36365 Medium 6.8 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent 0.3%
• CVE-2024-36364 Medium 6.5 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible 0.3%
• CVE-2024-36363 Medium 4.6 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible 0.3%
• CVE-2024-36362 Medium 6.5 In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible 0.5%
• CVE-2024-35302 Medium 5.4 In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible 0.3%
• CVE-2024-35301 Medium 5.5 In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token 0.3%
• CVE-2024-35300 Low 3.5 In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible 0.3%
• CVE-2024-31140 Medium 4.1 In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools 0.4%
• CVE-2024-31139 Medium 5.9 In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector 0.5%
• CVE-2024-31138 Medium 4.6 In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings 74.7%
• CVE-2024-31137 Medium 6.8 In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration 0.4%
• CVE-2024-31136 High 7.4 In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter 0.5%
• CVE-2024-31135 Medium 6.1 In JetBrains TeamCity before 2024.03 open redirect was possible on the login page 0.5%
• CVE-2024-31134 Medium 6.5 In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled 0.4%
• CVE-2024-29880 Medium 4.2 In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process 0.2%
• CVE-2024-28174 Medium 5.8 In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly 0.3%
• CVE-2024-28173 Medium 4.3 In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed 0.5%
• CVE-2024-23917 Critical 9.8 In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible 54.0%
• CVE-2024-24942 Medium 5.3 In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives 32.0%
• CVE-2024-24938 Medium 5.3 In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation 0.7%
• CVE-2024-24937 Medium 4.6 In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible 0.4%
• CVE-2024-24936 Medium 4.3 In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed 0.3%
• CVE-2023-50870 Medium 4.3 In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible 0.3%
• CVE-2023-43566 Low 3.5 In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration 1.0%
• CVE-2023-41250 Low 3.5 In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration 0.4%
• CVE-2023-41249 Medium 4.6 In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step 55.5%
• CVE-2023-41248 Medium 4.6 In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration 0.4%
• CVE-2023-39175 Medium 4.6 In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible 1.0%