cbcvebase.

Jetbrains Teamcity vulnerabilities

284 known vulnerabilities affecting jetbrains/teamcity.

Total CVEs
284
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL30HIGH59MEDIUM186LOW9

Vulnerabilities

Page 6 of 15
CVE-2025-54529P3HIGHCVSS 7.5fixed in 2025.072025-07-28
CVE-2025-54529 [HIGH] CWE-352 CVE-2025-54529: In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
nvd
CVE-2024-56356P3HIGHCVSS 7.1fixed in 2024.122024-12-20
CVE-2024-56356 [HIGH] CWE-611 CVE-2024-56356: In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE at In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
nvd
CVE-2023-38062P3MEDIUMCVSS 6.5fixed in 2023.05.12023-07-12
CVE-2023-38062 [MEDIUM] CWE-200 CVE-2023-38062: In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations
nvd
CVE-2025-31139P3MEDIUMCVSS 6.5fixed in 2025.032025-03-27
CVE-2025-31139 [MEDIUM] CWE-532 CVE-2025-31139: In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
nvd
CVE-2025-46432P3MEDIUMCVSS 6.5fixed in 2025.03.12025-04-25
CVE-2025-46432 [MEDIUM] CWE-532 CVE-2025-46432: In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
nvd
CVE-2022-36321P4MEDIUMCVSS 6.5fixed in 2022.04.2≥ 2022.04.2, < 2022.04.22022-07-20
CVE-2022-36321 [MEDIUM] CWE-532 CVE-2022-36321: In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases
nvd
CVE-2024-36364P4MEDIUMCVSS 6.5fixed in 2022.04.7≥ 2022.10, < 2022.10.6+3 more2024-05-29
CVE-2024-36364 [MEDIUM] CWE-863 CVE-2024-36364: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in P In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
nvd
CVE-2024-56353P4MEDIUMCVSS 6.5fixed in 2024.122024-12-20
CVE-2024-56353 [MEDIUM] CWE-212 CVE-2024-56353: In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
nvd
CVE-2025-24461P4MEDIUMCVSS 6.5v2024.12.1fixed in 2024.12.12025-01-21
CVE-2025-24461 [MEDIUM] CWE-862 CVE-2025-24461: In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions w In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
nvd
CVE-2024-47161P3MEDIUMCVSS 6.5fixed in 2024.07.32024-10-08
CVE-2024-47161 [MEDIUM] CWE-522 CVE-2024-47161: In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
nvd
CVE-2026-49376P4MEDIUMCVSS 6.5fixed in 2026.12026-05-29
CVE-2026-49376 [MEDIUM] CWE-863 CVE-2026-49376: In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
nvd
CVE-2024-41828P4MEDIUMCVSS 6.5fixed in 2024.072024-07-22
CVE-2024-41828 [MEDIUM] CWE-208 CVE-2024-41828: In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
nvd
CVE-2025-68267P3MEDIUMCVSS 6.5fixed in 2025.11.12025-12-16
CVE-2025-68267 [MEDIUM] CWE-272 CVE-2025-68267: In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub pers In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
nvd
CVE-2019-12841P4HIGHCVSS 7.5fixed in 2018.2.22019-07-03
CVE-2019-12841 [HIGH] CWE-20 CVE-2019-12841: Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.
nvd
CVE-2019-15042P4HIGHCVSS 7.5v2018.2.42019-10-01
CVE-2019-15042 [HIGH] CWE-295 CVE-2019-15042: An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for som An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
nvd
CVE-2025-52877P4MEDIUMCVSS 4.8fixed in 2025.03.32025-06-23
CVE-2025-52877 [MEDIUM] CWE-79 CVE-2025-52877: In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
nvd
CVE-2023-38064P4MEDIUMCVSS 6.5fixed in 2023.05.12023-07-12
CVE-2023-38064 [MEDIUM] CWE-532 CVE-2023-38064: In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be writte In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log
nvd
CVE-2023-38067P4MEDIUMCVSS 6.5fixed in 2023.05.12023-07-12
CVE-2023-38067 [MEDIUM] CWE-532 CVE-2023-38067: In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to t In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log
nvd
CVE-2024-31134P4MEDIUMCVSS 6.5fixed in 2024.032024-03-28
CVE-2024-31134 [MEDIUM] CWE-863 CVE-2024-31134: In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could re In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled
nvd
CVE-2024-41824P4MEDIUMCVSS 6.5fixed in 2024.072024-07-22
CVE-2024-41824 [MEDIUM] CWE-532 CVE-2024-41824: In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
nvd
← Previous6 / 15Next →