In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

In JetBrains TeamCity before 2024.03 open redirect was possible on the login page

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.

In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible

In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible

In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page

In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible

In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab

In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup

In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible

In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests

In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration

JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

In JetBrains TeamCity before 2020.2.3, XSS was possible.

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations

In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible

In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible

In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration

In JetBrains Hub before 2021.1.13690, stored XSS is possible.

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.

In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.

In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions

JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack

In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.

JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation

In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.

JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.