Jetbrains Teamcity vulnerabilities, page 5
284 vulnerabilities
Known vulnerabilities in Jetbrains Teamcity, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-67739jetbrainsteamcity
EPSS score0.17%
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureCVE-2025-67741jetbrainsteamcityEPSS score0.49%
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attributeCVE-2025-67740jetbrainsteamcityEPSS score0.22%
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadataCVE-2025-46433jetbrainsteamcityEPSS score0.55%
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possibleCVE-2025-46618jetbrainsteamcityEPSS score63.03%
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabCVE-2025-46432jetbrainsteamcityEPSS score1.01%
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsCVE-2025-24461jetbrainsteamcityEPSS score0.31%
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpointCVE-2025-24459jetbrainsteamcityEPSS score2.84%
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection pageCVE-2025-24460jetbrainsteamcityEPSS score0.27%
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent poolCVE-2020-11938jetbrainsteamcityEPSS score0.86%
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.CVE-2020-11686jetbrainsteamcityEPSS score0.75%
In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.CVE-2020-11687jetbrainsteamcityEPSS score1.08%
In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.CVE-2020-11688jetbrainsteamcityEPSS score1.00%
In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.CVE-2020-11689jetbrainsteamcityEPSS score0.63%
In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.CVE-2020-7909jetbrainsteamcityEPSS score1.13%
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.CVE-2020-7910jetbrainsteamcityEPSS score0.53%
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.CVE-2020-7908jetbrainsteamcityEPSS score0.85%
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.CVE-2020-7911jetbrainsteamcityEPSS score0.65%
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.CVE-2020-27627jetbrainsteamcityEPSS score0.74%
JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.CVE-2020-27628jetbrainsteamcityEPSS score0.75%
In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.