In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.

In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.

In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.

In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

In JetBrains TeamCity before 2021.1.2, user enumeration was possible.

In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.

In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.

In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.

In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.

In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection

In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.

In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.

In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly

In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.

In JetBrains Ktor before 2.3.13 improper caching in HttpCache Plugin could lead to response information disclosure

In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.

In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.

JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials.

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.