In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file.

In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.

In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.

In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.

In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.

In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.

Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.

In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.

In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.

JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.

JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.

In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.

In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.

In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation

In JetBrains Ktor before 2.3.5 server certificates were not verified

In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). libcurl supports by default the use of TLS session id/ticket to resume previous TLS sessions to speed up subsequent TLS handshakes. They are used when for any reason an existing TLS connection couldn't be kept alive to make the next handshake faster. This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range.

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.

A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to access the Autonomic Networking infrastructure of an affected system, after the certificate for the autonomic node has been revoked. This vulnerability affected devices that are running Release 16.x of Cisco IOS XE Software and are configured to use Autonomic Networking. This vulnerability does not affect devices that are running an earlier release of Cisco IOS XE Software or devices that are not configured to use Autonomic Networking. More Information: CSCvd22328. Known Affected Releases: 15.5(1)S3.1 Denali-16.2.1.

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).

An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Security" component. It allows remote attackers to bypass intended certificate-trust restrictions via a revoked X.509 certificate.

The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mechanism by leveraging failure to add the previous hop realm to the transit path of issued tickets.

vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate)

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate.