Jetbrains Teamcity vulnerabilities
284 known vulnerabilities affecting jetbrains/teamcity.
Total CVEs
284
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL30HIGH59MEDIUM186LOW9
Vulnerabilities
Page 13 of 15
CVE-2022-29929P4MEDIUMCVSS 6.1fixed in 2022.04≥ 2022.04, < 2022.042022-05-12
CVE-2022-29929 [MEDIUM] CWE-79 CVE-2022-29929: In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible
In JetBrains TeamCity before 2022.04 potential XSS via Referrer header was possible
nvd
CVE-2023-41250P4MEDIUMCVSS 6.1fixed in 2023.05.32023-08-25
CVE-2023-41250 [MEDIUM] CWE-79 CVE-2023-41250: In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registration
nvd
CVE-2019-12845P4MEDIUMCVSS 5.3fixed in 2018.2.32019-07-03
CVE-2019-12845 [MEDIUM] CWE-287 CVE-2019-12845: The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts
The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.
nvd
CVE-2019-18367P4MEDIUMCVSS 5.3fixed in 2019.1.22019-10-31
CVE-2019-18367 [MEDIUM] CWE-276 CVE-2019-18367: In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user with
In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
nvd
CVE-2021-25777P4MEDIUMCVSS 5.3fixed in 2020.2.12021-02-03
CVE-2021-25777 [MEDIUM] CWE-863 CVE-2021-25777: In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
nvd
CVE-2024-43810P4MEDIUMCVSS 5.4fixed in 2024.07.12024-08-16
CVE-2024-43810 [MEDIUM] CWE-79 CVE-2024-43810: In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
nvd
CVE-2024-43808P4MEDIUMCVSS 5.4fixed in 2024.07.12024-08-16
CVE-2024-43808 [MEDIUM] CWE-79 CVE-2024-43808: In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
nvd
CVE-2022-29928P4MEDIUMCVSS 4.9fixed in 2022.04≥ 2022.04, < 2022.042022-05-12
CVE-2022-29928 [MEDIUM] CWE-532 CVE-2022-29928: In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
nvd
CVE-2023-38066P4MEDIUMCVSS 6.1fixed in 2023.05.12023-07-12
CVE-2023-38066 [MEDIUM] CWE-79 CVE-2023-38066: In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during arti
In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
nvd
CVE-2019-12842P4MEDIUMCVSS 6.1fixed in 2018.2.22019-07-03
CVE-2019-12842 [MEDIUM] CWE-79 CVE-2019-12842: A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fi
A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
nvd
CVE-2019-15037P4MEDIUMCVSS 6.1v2018.2.42019-10-02
CVE-2019-15037 [MEDIUM] CWE-79 CVE-2019-15037: An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the se
An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.
nvd
CVE-2024-31135P4MEDIUMCVSS 6.1fixed in 2024.032024-03-28
CVE-2024-31135 [MEDIUM] CWE-601 CVE-2024-31135: In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
nvd
CVE-2026-49381P4MEDIUMCVSS 4.8fixed in 2026.12026-05-29
CVE-2026-49381 [MEDIUM] CWE-79 CVE-2026-49381: In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
nvd
CVE-2021-25774P4MEDIUMCVSS 4.3fixed in 2020.2.12021-02-03
CVE-2021-25774 [MEDIUM] CWE-863 CVE-2021-25774: In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
nvd
CVE-2025-54533P4MEDIUMCVSS 4.3fixed in 2025.072025-07-28
CVE-2025-54533 [MEDIUM] CWE-863 CVE-2025-54533: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings vi
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
nvd
CVE-2014-10002P4MEDIUMCVSS 5.0≤ 8.02015-01-13
CVE-2014-10002 [MEDIUM] CVE-2014-10002: Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensiti
Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.
nvd
CVE-2024-41826P4MEDIUMCVSS 4.8fixed in 2024.072024-07-22
CVE-2024-41826 [MEDIUM] CWE-79 CVE-2024-41826: In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
nvd
CVE-2025-68163P4MEDIUMCVSS 4.8fixed in 2025.112025-12-16
CVE-2025-68163 [MEDIUM] CWE-79 CVE-2025-68163: In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
nvd
CVE-2020-27628P4MEDIUMCVSS 4.3fixed in 2020.1.52020-11-16
CVE-2020-27628 [MEDIUM] CVE-2020-27628: In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
nvd
CVE-2023-34219P4MEDIUMCVSS 4.3fixed in 2023.052023-05-31
CVE-2023-34219 [MEDIUM] CWE-285 CVE-2023-34219: In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate pe
In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API
nvd