In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.

In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.

In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.

In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file.

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.

In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.

In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible

In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.

In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.

In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration

In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab

In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

JetBrains Ktor framework before version 1.2.6 was vulnerable to HTTP Response Splitting.

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.

Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.

In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.

In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.