In JetBrains TeamCity before 2024.03 open redirect was possible on the login page

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL

In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.

In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible

In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered

In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.

In JetBrains TeamCity before 2021.1.2, stored XSS is possible.

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible

In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible

In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.

In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab

JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.

In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.

In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS

A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.

Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.