Jetbrains Teamcity vulnerabilities
284 known vulnerabilities affecting jetbrains/teamcity.
Total CVEs
284
CISA KEV
4
actively exploited
Public exploits
6
Exploited in wild
5
Severity breakdown
CRITICAL30HIGH59MEDIUM186LOW9
Vulnerabilities
Page 8 of 15
CVE-2025-67740P4MEDIUMCVSS 5.3fixed in 2025.112025-12-11
CVE-2025-67740 [MEDIUM] CWE-863 CVE-2025-67740: In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadat
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
nvd
CVE-2020-27627P4MEDIUMCVSS 6.1fixed in 2020.1.22020-11-16
CVE-2020-27627 [MEDIUM] CWE-74 CVE-2020-27627: JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
nvd
CVE-2025-26493P4MEDIUMCVSS 6.1fixed in 2024.12.22025-02-11
CVE-2025-26493 [MEDIUM] CWE-79 CVE-2025-26493: In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Re
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
nvd
CVE-2026-28194P4MEDIUMCVSS 6.1fixed in 2025.11.32026-02-25
CVE-2026-28194 [MEDIUM] CWE-601 CVE-2026-28194: In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
nvd
CVE-2025-68166P4MEDIUMCVSS 6.1fixed in 2025.112025-12-16
CVE-2025-68166 [MEDIUM] CWE-79 CVE-2025-68166: In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
nvd
CVE-2024-28174P4MEDIUMCVSS 5.8fixed in 2023.11.42024-03-06
CVE-2024-28174 [MEDIUM] CWE-863 CVE-2024-28174: In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plug
In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly
nvd
CVE-2023-34223P4MEDIUMCVSS 5.3fixed in 2023.052023-05-31
CVE-2023-34223 [MEDIUM] CWE-532 CVE-2023-34223: In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could
In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases
nvd
CVE-2024-56352P4MEDIUMCVSS 5.4fixed in 2024.122024-12-20
CVE-2024-56352 [MEDIUM] CWE-79 CVE-2024-56352: In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pag
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
nvd
CVE-2025-47853P4MEDIUMCVSS 5.4fixed in 2025.03.22025-05-20
CVE-2025-47853 [MEDIUM] CWE-79 CVE-2025-47853: In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
nvd
CVE-2025-47852P4MEDIUMCVSS 5.4fixed in 2025.03.22025-05-20
CVE-2025-47852 [MEDIUM] CWE-79 CVE-2025-47852: In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
nvd
CVE-2019-18363P4MEDIUMCVSS 5.3fixed in 2019.1.22019-10-31
CVE-2019-18363 [MEDIUM] CVE-2019-18363: In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted
In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
nvd
CVE-2025-67741P4MEDIUMCVSS 5.4fixed in 2025.112025-12-11
CVE-2025-67741 [MEDIUM] CWE-79 CVE-2025-67741: In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
nvd
CVE-2024-43807P4MEDIUMCVSS 5.4fixed in 2024.07.12024-08-16
CVE-2024-43807 [MEDIUM] CWE-79 CVE-2024-43807: In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
nvd
CVE-2024-41825P4MEDIUMCVSS 5.4fixed in 2024.072024-07-22
CVE-2024-41825 [MEDIUM] CWE-79 CVE-2024-41825: In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
nvd
CVE-2026-111096P4MEDIUMCVSS 5.4fixed in 2025.11.8≥ 2026.1, < 2026.1.4+1 more2026-10-15
CVE-2026-111096 [MEDIUM] CWE-79 CVE-2026-111096: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was p
In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible
nvd
CVE-2024-56349P4MEDIUMCVSS 5.3fixed in 2024.122024-12-20
CVE-2024-56349 [MEDIUM] CWE-862 CVE-2024-56349: In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify bu
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
nvd
CVE-2019-15848P4MEDIUMCVSS 6.1v2019.1v2019.1.12019-09-05
CVE-2019-15848 [MEDIUM] CWE-79 CVE-2019-15848: JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it poss
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
nvd
CVE-2023-34222P4MEDIUMCVSS 6.1fixed in 2023.052023-05-31
CVE-2023-34222 [MEDIUM] CWE-79 CVE-2023-34222: In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible
In JetBrains TeamCity before 2023.05 possible XSS in the Plugin Vendor URL was possible
nvd
CVE-2019-12843P4MEDIUMCVSS 6.1fixed in 2018.2.32019-07-03
CVE-2019-12843 [MEDIUM] CWE-94 CVE-2019-12843: A possible stored JavaScript injection requiring a deliberate server administrator action was detect
A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.
nvd
CVE-2024-35300P4MEDIUMCVSS 6.1v2024.03≥ 2024.03, < 2024.03.12024-05-16
CVE-2024-35300 [MEDIUM] CWE-79 CVE-2024-35300: In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page
In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible
nvd