Jetbrains vulnerabilities, page 3
696 vulnerabilities
Known vulnerabilities in Jetbrains products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 42 products.
CVE-2021-25761jetbrainsktor
EPSS score0.54%
In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.CVE-2021-25769jetbrainsyoutrackEPSS score1.77%
In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.CVE-2021-25760jetbrainshubEPSS score0.86%
In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.CVE-2021-25775jetbrainsteamcityEPSS score0.63%
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.CVE-2021-25765jetbrainsyoutrackEPSS score0.71%
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.CVE-2021-25770jetbrainsyoutrackEPSS score3.47%
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.CVE-2021-25773jetbrainsteamcityEPSS score0.65%
JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.CVE-2021-25755jetbrainscode_with_meEPSS score0.38%
In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.CVE-2021-25764jetbrainsphpstormEPSS score0.80%
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs.CVE-2021-25766jetbrainsyoutrackEPSS score1.43%
In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.CVE-2021-25778jetbrainsteamcityEPSS score0.77%
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.CVE-2021-25763jetbrainsktorEPSS score0.54%
In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.CVE-2021-25772jetbrainsteamcityEPSS score1.03%
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.CVE-2021-37548jetbrainsteamcityEPSS score0.63%
In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.CVE-2021-37550jetbrainsyoutrackEPSS score1.13%
In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.CVE-2021-37549jetbrainsyoutrackEPSS score1.35%
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.CVE-2021-37544jetbrainsteamcityEPSS score1.20%
In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.CVE-2021-37540jetbrainshubEPSS score0.66%
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.CVE-2021-37551jetbrainsyoutrackEPSS score0.70%
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.CVE-2021-37554jetbrainsyoutrackEPSS score0.88%
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.