Vulnerabilidades

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed

In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible

In JetBrains Ktor before 2.3.5 server certificates were not verified

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration

In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configuration

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions

In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers

In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access

In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases

In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms

In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log

In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads

In JetBrains TeamCity before 2023.05.1 stored XSS while viewing the build log was possible

In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log

In JetBrains TeamCity before 2023.05.1 stored XSS while running custom builds was possible

In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations

In JetBrains TeamCity before 2023.05.1 stored XSS when using a custom theme was possible

JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.

In JetBrains YouTrack before 2023.1.10518 stored XSS in a Markdown-rendering engine was possible

In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms