In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin

In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin

In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.

JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.

In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

JetBrains Space through 2020-04-22 allows stored XSS in Chats.

In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible

In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads

In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible

In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible

In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible

In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible

In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible

In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule

In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page

In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab