JetBrains TeamCity Jira Integration Cross-Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. JetBrains TeamCity suffers from a cross-site scripting vulnerability that originates in the Jira integration and can be exploited by an attacker to inject malicious scrip...

CVE-2025-24461

In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint...

CVE-2025-24459

In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page...

CVE-2025-24460

In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool...

CVE-2024-47161

In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API...

CVE-2024-47950

In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings...

CVE-2024-47948

In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups...

CVE-2024-47951

In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings...

CVE-2024-47949

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location...

CVE-2024-43810

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin...

CVE-2024-43809

In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page...

CVE-2024-43807

In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page...

CVE-2024-43808

In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin...

CVE-2024-31137

In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration...

CVE-2024-31140

In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools...

CVE-2024-31134

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled...

CVE-2024-31135

In JetBrains TeamCity before 2024.03 open redirect was possible on the login page...

CVE-2024-31139

In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector...

CVE-2024-31138

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings...

CVE-2024-29880

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process...