Security feature bypass

Rejected reason: We have rejected this CVE as it was determined a non-security issue by the vendor...

Cross site scripting

A cross-site scripting XSS vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views the Debug Samples tab in the web UI...

CVE-2024-24590

ClearML (Allegro AI) client SDK vulnerabilities: deserialization of untrusted data in versions 0.17.0–1.14.2 can allow remote code execution via a malicious pickle artifact. Root cause: unsafe Python pickle deserialization during artifact processing. Impact: arbitrary code execution/reverse shell...

CVE-2024-0911

CVE-2024-0911 affects the GNU indent utility, where a heap-based buffer overflow in set_buf_break() can be triggered by processing a specially crafted file, potentially causing the application to crash. The provided documents describe the vulnerability as originating from indent, a C formatter, w...

Code injection

In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed...

Authentication flaw

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible...

Directory traversal

In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation...

Path traversal

In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives...

Information disclosure

In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image...

Authentication flaw

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL...

Cross site scripting

In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible...

CVE-2024-23673

CVE-2024-23673 concerns a path-traversal vulnerability in Apache Sling Servlets Resolver. The issue affects all versions prior to 2.11.0, with exploitation dependent on system configuration; a user with write access to the repository could trick the resolver into loading a previously uploaded scr...

CVE-2024-24943

CVE-2024-24943 affects JetBrains Toolbox App prior to 2.2. Affected component: parsing/rendering of SVG images, with root cause described as a DoS in a malicious SVG image leading to availability impact. Reported impact: availability loss (DoS) with no confidentiality/integrity impact per sources...

CVE-2024-24942

CVE-2024-24942 affects JetBrains TeamCity versions prior to 2023.11.3. The vulnerability is a path traversal in JAR archives that allows reading data from within JAR files. Public sources in the connected documents consistently describe the issue as a path traversal vulnerability in TeamCity lead...

CVE-2024-23917

JetBrains TeamCity On-Premises older than 2023.11.3 is vulnerable to an authentication bypass that can lead to remote code execution and full administrative access. Impact: unauthenticated attackers could gain control of the TeamCity server. Remediation: upgrade to TeamCity 2023.11.3 or later. Th...

CVE-2024-24940

JetBrains IntelliJ IDEA prior to 2023.3.3 is affected by CVE-2024-24940, where path traversal is possible when unpacking archives. The issue arises in the Archive Extraction Handler component of the IDE. Red Hat and other sources confirm the vulnerability affects versions before 2023.3.3. Reporte...

CVE-2024-24939

In JetBrains Rider, prior to version 2023.3.3, the product could log environment variables that contained secret values. This was reported across multiple sources (NVD, Red Hat, PRION/PTSecurity and others), with the common root cause described as inadequate handling/logging of sensitive environm...

CVE-2024-24937

JetBrains TeamCity Server prior to 2023.11.2 is affected by a stored cross-site scripting (XSS) vulnerability stemming from agent distribution. The issue allows XSS through the agent distribution channel, as described in CVE-2024-24937 and corroborated by multiple sources referencing TeamCity’s p...

CVE-2024-24936

JetBrains TeamCity Server prior to 2023.11.2 is affected by CVE-2024-24936 due to missing access control at the S3 Artifact Storage plugin endpoint. The vulnerability allows unauthorized access at that endpoint (root cause: improper access control). A patch is available: upgrade to 2023.11.2 or l...

CVE-2024-0684

CVE-2024-0684 affects GNU coreutils split. A heap overflow in line_bytes_split() can be triggered by user-controlled data of hundreds of bytes, potentially causing an application crash and denial of service. Affected: coreutils split in vulnerable versions prior to fixed release. Public details i...