Filtered by vendor Jetbrains
Subscribe
Total
456 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-12157 | 1 Jetbrains | 2 Teamcity, Upsource | 2024-11-21 | 10.0 HIGH | 9.8 CRITICAL |
| In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands. | |||||
| CVE-2019-12156 | 1 Jetbrains | 1 Upsource | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
| Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293. | |||||
| CVE-2019-10104 | 1 Jetbrains | 1 Intellij Idea | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin, or CloudBees) with the default setting allowed a remote attacker to execute code when the configuration is running, because a JMX server listened on all interfaces instead of localhost only. The issue has been fixed in the following versions: 2018.3.4, 2018.2.8, 2018.1.8, and 2017.3.7. | |||||
| CVE-2019-10103 | 1 Jetbrains | 1 Kotlin | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101. | |||||
| CVE-2019-10102 | 1 Jetbrains | 2 Kotlin, Ktor | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. This issue was fixed in Kotlin plugin version 1.3.30. | |||||
| CVE-2019-10101 | 1 Jetbrains | 1 Kotlin | 2024-11-21 | 6.8 MEDIUM | 8.1 HIGH |
| JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack. | |||||
| CVE-2019-10100 | 1 Jetbrains | 1 Youtrack Integration | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injection. The attacker could add an Issue macro to the page in Confluence, and use a combination of a valid id field and specially crafted code in the link-text-template field to execute code remotely. | |||||
| CVE-2018-14878 | 1 Jetbrains | 2 Dotpeek, Resharper Ultimate | 2024-11-21 | 6.8 MEDIUM | 7.8 HIGH |
| JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data. | |||||
| CVE-2017-8316 | 1 Jetbrains | 1 Intellij Idea | 2024-11-21 | 7.8 HIGH | 7.5 HIGH |
| IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both Androidmanifest.xml. | |||||
| CVE-2015-1313 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | N/A | 6.5 MEDIUM |
| JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request. | |||||
| CVE-2024-49579 | 1 Jetbrains | 1 Youtrack | 2024-11-14 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests | |||||
| CVE-2024-50575 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 5.4 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API | |||||
| CVE-2024-50576 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest | |||||
| CVE-2024-50577 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings | |||||
| CVE-2024-50578 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page | |||||
| CVE-2024-50579 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible | |||||
| CVE-2024-50580 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule | |||||
| CVE-2024-50581 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag | |||||
| CVE-2024-50582 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 4.6 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements | |||||
| CVE-2024-50574 | 1 Jetbrains | 1 Youtrack | 2024-10-29 | N/A | 5.3 MEDIUM |
| In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality | |||||