Vulnerabilidades

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

In JetBrains TeamCity before 2023.05 stored XSS in GitLab Connection page was possible

In JetBrains TeamCity before 2023.05 authentication checks were missing – 2FA was not checked for some sensitive account actions

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible

In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.

In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.

In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.

In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible