Jetbrains Teamcity vulnerabilities

284 known vulnerabilities affecting jetbrains/teamcity.

Total CVEs

284

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL30HIGH59MEDIUM186LOW9

Vulnerabilities

SortPage 12 of 15

CVE-2021-25778P4MEDIUMCVSS 5.3fixed in 2020.2.12021-02-03

CVE-2021-25778 [MEDIUM] CVE-2021-25778: In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

nvd

CVE-2021-43201P4MEDIUMCVSS 5.3fixed in 2021.1.32021-11-09

CVE-2021-43201 [MEDIUM] CVE-2021-43201: In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already d In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.

nvd

CVE-2022-24334P4MEDIUMCVSS 5.3fixed in 2021.2.12022-02-25

CVE-2022-24334 [MEDIUM] CVE-2022-24334: In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key o In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

nvd

CVE-2022-24332P4MEDIUMCVSS 5.3fixed in 2021.22022-02-25

CVE-2022-24332 [MEDIUM] CWE-613 CVE-2022-24332: In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

nvd

CVE-2021-37546P4MEDIUMCVSS 5.3fixed in 2021.12021-08-06

CVE-2021-37546 [MEDIUM] CWE-327 CVE-2021-37546: In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties w In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.

nvd

CVE-2024-36368P4MEDIUMCVSS 5.4fixed in 2022.04.7≥ 2022.10, < 2022.10.6+3 more2024-05-29

CVE-2024-36368 [MEDIUM] CWE-79 CVE-2024-36368: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth prov In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible

nvd

CVE-2024-36371P4MEDIUMCVSS 5.4fixed in 2023.05.6≥ 2023.11, < 2023.11.5+1 more2024-05-29

CVE-2024-36371 [MEDIUM] CWE-79 CVE-2024-36371: In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible

nvd

CVE-2019-15035P4MEDIUMCVSS 4.9v2018.2.42019-10-01

CVE-2019-15035 [MEDIUM] CVE-2019-15035: An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get a An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.

nvd

CVE-2020-11938P4MEDIUMCVSS 4.9≥ 2018.2, ≤ 2019.2.12020-04-22

CVE-2020-11938 [MEDIUM] CVE-2020-11938: In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled pas In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.

nvd

CVE-2022-46831P4MEDIUMCVSS 4.9≥ 2022.10, ≤ 2022.10.1≥ 2022.10, < 2022.10.12022-12-08

CVE-2022-46831 [MEDIUM] CWE-453 CVE-2022-46831: In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.

nvd

CVE-2024-56354P4MEDIUMCVSS 4.9fixed in 2024.122024-12-20

CVE-2024-56354 [MEDIUM] CWE-522 CVE-2024-56354: In JetBrains TeamCity before 2024.12 password field value were accessible to users with view setting In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission

nvd

CVE-2026-28195P4MEDIUMCVSS 4.3fixed in 2025.11.32026-02-25

CVE-2026-28195 [MEDIUM] CWE-862 CVE-2026-28195: In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add param In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

nvd

CVE-2023-34226P4MEDIUMCVSS 6.1fixed in 2023.052023-05-31

CVE-2023-34226 [MEDIUM] CWE-79 CVE-2023-34226: In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible

nvd

CVE-2021-31911P4MEDIUMCVSS 6.1fixed in 2020.2.32021-05-11

CVE-2021-31911 [MEDIUM] CWE-79 CVE-2021-31911: In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages. In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.

nvd

CVE-2021-31904P4MEDIUMCVSS 6.1fixed in 2020.2.22021-05-11

CVE-2021-31904 [MEDIUM] CWE-79 CVE-2021-31904: In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page. In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.

nvd

CVE-2020-15831P4MEDIUMCVSS 6.1fixed in 2019.2.32020-08-08

CVE-2020-15831 [MEDIUM] CWE-79 CVE-2020-15831: JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI. JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

nvd

CVE-2021-25773P4MEDIUMCVSS 6.1fixed in 2020.22021-02-03

CVE-2021-25773 [MEDIUM] CWE-79 CVE-2021-25773: JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

nvd

CVE-2021-43197P4MEDIUMCVSS 6.1fixed in 2021.1.22021-11-09

CVE-2021-43197 [MEDIUM] CWE-79 CVE-2021-43197: In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.

nvd

CVE-2022-25261P4MEDIUMCVSS 6.1fixed in 2021.2.22022-02-25

CVE-2022-25261 [MEDIUM] CWE-79 CVE-2022-25261: JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

nvd

CVE-2022-24338P4MEDIUMCVSS 6.1fixed in 2021.2.12022-02-25

CVE-2022-24338 [MEDIUM] CWE-79 CVE-2022-24338: JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

nvd

← Previous12 / 15Next →