Total 582 security vulnerabilities recorded for jetbrains software and firmware.
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint...
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible...
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible...
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...
In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH...
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page...
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token...
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab...
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup...
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test...
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page...
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration...
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload...
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute...
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata...
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure...
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit...
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure...
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form...
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API...
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit...
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations...
In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition...
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation...