JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

In JetBrains Hub before 2021.1.13690, stored XSS is possible.

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible

In JetBrains TeamCity before 2020.2.3, XSS was possible.

In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible

In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.

Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.

JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.

JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.

A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations

In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.

In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.