Jetbrains Teamcity vulnerabilities
284 known vulnerabilities affecting jetbrains/teamcity.
Total CVEs
284
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL30HIGH59MEDIUM186LOW9
Vulnerabilities
Page 14 of 15
CVE-2024-56348P4MEDIUMCVSS 4.3fixed in 2024.122024-12-20
CVE-2024-56348 [MEDIUM] CWE-863 CVE-2024-56348: In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
nvd
CVE-2024-56350P4MEDIUMCVSS 4.3fixed in 2024.122024-12-20
CVE-2024-56350 [MEDIUM] CWE-863 CVE-2024-56350: In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
nvd
CVE-2025-24460P4MEDIUMCVSS 4.3fixed in 2024.12.12025-01-21
CVE-2025-24460 [MEDIUM] CWE-863 CVE-2025-24460: In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
nvd
CVE-2025-54532P4MEDIUMCVSS 4.3fixed in 2025.072025-07-28
CVE-2025-54532 [MEDIUM] CWE-863 CVE-2025-54532: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings vi
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
nvd
CVE-2025-59455P4MEDIUMCVSS 4.2fixed in 2025.07.22025-09-17
CVE-2025-59455 [MEDIUM] CWE-362 CVE-2025-59455: In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
nvd
CVE-2025-52879P4MEDIUMCVSS 4.8fixed in 2025.03.32025-06-23
CVE-2025-52879 [MEDIUM] CWE-79 CVE-2025-52879: In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
nvd
CVE-2025-54534P4MEDIUMCVSS 4.8fixed in 2025.072025-07-28
CVE-2025-54534 [MEDIUM] CWE-79 CVE-2025-54534: In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
nvd
CVE-2019-12846P4MEDIUMCVSS 4.3fixed in 2018.2.22019-07-03
CVE-2019-12846 [MEDIUM] CVE-2019-12846: A user without the required permissions could gain access to some JetBrains TeamCity settings. The i
A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.
nvd
CVE-2024-28173P4MEDIUMCVSS 4.3≥ 2023.11, < 2023.11.42024-03-06
CVE-2024-28173 [MEDIUM] CWE-201 CVE-2024-28173: In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type c
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
nvd
CVE-2014-10036P4MEDIUMCVSS 4.3≤ 8.02015-01-13
CVE-2014-10036 [MEDIUM] CWE-79 CVE-2014-10036: Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to
Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.
nvd
CVE-2025-52878P4MEDIUMCVSS 4.3fixed in 2025.03.32025-06-23
CVE-2025-52878 [MEDIUM] CWE-862 CVE-2025-52878: In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permission
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
nvd
CVE-2020-7908P4MEDIUMCVSS 4.3fixed in 2019.1.52020-01-30
CVE-2020-7908 [MEDIUM] CWE-269 CVE-2020-7908: In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
nvd
CVE-2019-18365P4MEDIUMCVSS 4.3fixed in 2019.1.42019-10-31
CVE-2019-18365 [MEDIUM] CWE-269 CVE-2019-18365: In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
nvd
CVE-2020-15826P4MEDIUMCVSS 4.3fixed in 2020.12020-08-08
CVE-2020-15826 [MEDIUM] CWE-269 CVE-2020-15826: In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
nvd
CVE-2023-34224P4MEDIUMCVSS 4.8fixed in 2023.052023-05-31
CVE-2023-34224 [MEDIUM] CWE-601 CVE-2023-34224: In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible
In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible
nvd
CVE-2021-25775P4LOWCVSS 3.8fixed in 2020.2.12021-02-03
CVE-2021-25775 [LOW] CVE-2021-25775: In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any o
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
nvd
CVE-2025-57733P4LOWCVSS 3.8fixed in 2025.07.12025-08-20
CVE-2025-57733 [LOW] CWE-77 CVE-2025-57733: In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email co
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
nvd
CVE-2025-67739P4LOWCVSS 3.1fixed in 2025.11.22025-12-11
CVE-2025-67739 [LOW] CWE-939 CVE-2025-67739: In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
nvd
CVE-2025-68164P4LOWCVSS 2.7fixed in 2025.112025-12-16
CVE-2025-68164 [LOW] CWE-203 CVE-2025-68164: In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
nvd
CVE-2025-68162P4LOWCVSS 2.7fixed in 2025.112025-12-16
CVE-2025-68162 [LOW] CWE-829 CVE-2025-68162: In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configura
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
nvd