Teamcity Security Vulnerabilities
Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.
6.3AI Score
0.001EPSS
Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.
5.9AI Score
0.002EPSS
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.
6.5CVSS
6.4AI Score
0.001EPSS
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
9.8CVSS
9.2AI Score
0.002EPSS
Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.
7.5CVSS
7.5AI Score
0.001EPSS
A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
6.1CVSS
5.9AI Score
0.001EPSS
A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.
6.1CVSS
6.3AI Score
0.001EPSS
A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.
6.1CVSS
6.3AI Score
0.001EPSS
The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.
5.3CVSS
5.3AI Score
0.001EPSS
A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.
4.3CVSS
4.7AI Score
0.001EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
4.9CVSS
5AI Score
0.001EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
7.2CVSS
7.1AI Score
0.002EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.
6.1CVSS
6.1AI Score
0.001EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.
7.5CVSS
7.5AI Score
0.001EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
9.8CVSS
9.6AI Score
0.169EPSS
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
7.5CVSS
7.5AI Score
0.001EPSS
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
6.1CVSS
6AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
5.3CVSS
5.2AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
9.8CVSS
9.7AI Score
0.013EPSS
In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
4.3CVSS
4.7AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
5.3CVSS
5.2AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
5.3CVSS
5.2AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.
2.7CVSS
4AI Score
0.001EPSS
In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.
7.5CVSS
7.6AI Score
0.002EPSS
In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
7.5CVSS
7.5AI Score
0.001EPSS
In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.
6.5CVSS
6.3AI Score
0.001EPSS
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.
4.9CVSS
5.1AI Score
0.001EPSS
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.
8.8CVSS
8.6AI Score
0.001EPSS
In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
4.3CVSS
4.6AI Score
0.001EPSS
In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.
6.5CVSS
6.4AI Score
0.001EPSS
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
5.3CVSS
5.4AI Score
0.001EPSS
JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.
6.1CVSS
5.9AI Score
0.001EPSS
JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.
6.1CVSS
5.9AI Score
0.001EPSS
6.1CVSS
6.5AI Score
0.001EPSS
4.3CVSS
4.6AI Score
0.001EPSS
In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.
5.3CVSS
5.3AI Score
0.001EPSS
JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
7.5CVSS
7.4AI Score
0.002EPSS
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
4.3CVSS
4.7AI Score
0.001EPSS
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
7.5CVSS
7.5AI Score
0.002EPSS
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
5.4CVSS
5.1AI Score
0.001EPSS
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
6.1CVSS
6.2AI Score
0.001EPSS
In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
5.3CVSS
5.3AI Score
0.001EPSS
6.1CVSS
6AI Score
0.001EPSS
In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
4.3CVSS
4.6AI Score
0.001EPSS
In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
3.8CVSS
4.5AI Score
0.001EPSS
In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
7.5CVSS
7.4AI Score
0.002EPSS
In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
5.3CVSS
5.4AI Score
0.001EPSS
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
5.3CVSS
5.3AI Score
0.001EPSS
Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions.
3.3CVSS
3.9AI Score
0.0004EPSS
7.5CVSS
7.5AI Score
0.001EPSS