JetBrains TeamCity

• CVE-2023-39174 Medium 4.3 In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers 1.7%
• CVE-2023-39173 Medium 5.4 In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access 0.4%
• CVE-2023-38067 Medium 4.3 In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log 0.5%
• CVE-2023-38066 Medium 4.6 In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads 1.0%
• CVE-2023-38065 Medium 4.6 In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible 1.0%
• CVE-2023-38064 Medium 4.3 In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log 0.5%
• CVE-2023-38063 Medium 4.6 In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible 1.0%
• CVE-2023-38062 Medium 4.3 In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations 1.4%
• CVE-2023-38061 Medium 4.6 In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible 1.0%
• CVE-2023-34229 Medium 4.6 In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible 1.0%
• CVE-2023-34228 Medium 5.3 In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions 0.4%
• CVE-2023-34227 Medium 5.3 In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks 0.5%
• CVE-2023-34226 Medium 4.6 In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible 1.0%
• CVE-2023-34225 Medium 4.6 In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible 60.7%
• CVE-2023-34224 Medium 4.8 In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible 0.3%
• CVE-2023-34223 Medium 4.3 In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases 1.3%
• CVE-2023-34222 Medium 4.6 In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible 1.0%
• CVE-2023-34221 Medium 4.6 In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible 1.0%
• CVE-2023-34220 Medium 4.6 In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible 61.4%
• CVE-2023-34219 Medium 4.3 In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API 0.4%
• CVE-2023-34218 Critical 9.1 In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible 0.6%
• CVE-2022-48428 Medium 4.6 In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible 68.0%
• CVE-2022-48427 Medium 4.6 In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible 1.0%
• CVE-2022-48426 Medium 4.6 In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible 1.0%
• CVE-2022-48344 Medium 5.4 In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. 0.4%
• CVE-2022-48343 Medium 5.4 In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. 59.5%
• CVE-2022-48342 Medium 5.2 In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. 0.3%
• CVE-2022-46831 Medium 6.6 In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to 0.4%
• CVE-2022-46830 Medium 4.1 In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. 0.5%
• CVE-2022-44622 Low 2.7 In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive 0.6%
• CVE-2022-44646 Low 2.2 In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings 0.4%
• CVE-2022-44624 Medium 6.5 In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters 0.7%
• CVE-2022-44623 Medium 6.5 In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings 0.7%
• CVE-2022-40979 Medium 4.4 In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable 0.4%
• CVE-2022-38133 Low 3.2 In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases 0.5%
• CVE-2022-36322 Medium 5.4 In JetBrains TeamCity before 2022.04.2 build parameter injection was possible 0.7%
• CVE-2022-36321 Medium 4.1 In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases 1.9%
• CVE-2022-29929 Low 3.7 In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible 0.5%
• CVE-2022-29928 Medium 4.4 In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible 0.5%
• CVE-2022-29927 Medium 4.6 In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible 1.6%