Teamcity
Monthly
Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-whitelist bypass in the build messages protocol lets a serialized payload cross the deserialization trust boundary and execute code in the server process; the flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, unauthicated per the PR:N vector). There is no public exploit identified at time of analysis, CISA's SSVC records Exploitation as 'none' with Automatable set to 'no', and EPSS is low at 0.38% (31st percentile), though Technical Impact is rated 'total'. JetBrains has released fixes, so the primary risk is unpatched, network-reachable TeamCity servers whose agent-facing build messages channel is exposed beyond trusted build-agent hosts.
Information disclosure in JetBrains TeamCity before 2026.2.1 allows a crafted Git submodule URL to make the server read files from local repositories reachable by the TeamCity service account, exposing source code and other local repository contents. The supplied NVD vector rates this as network-reachable without privileges (PR:N), but our assessment applies a low-privileged precondition (PR:L), because the attacker must be able to influence a submodule URL - typically by committing a malicious .gitmodules file to a repository TeamCity checks out, or by controlling a VCS root - on an instance configured to resolve Git submodules. Impact is confidentiality-only with no integrity or availability effect; EPSS is low (0.62%, 48th percentile), SSVC records no exploitation activity, and no public exploit code has been identified at time of analysis.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability.
Command execution on Windows-based JetBrains TeamCity servers allows authenticated users with Pipeline Git connection configuration privileges to run arbitrary OS commands via CRLF injection in connection settings, affecting versions before 2026.2, 2026.1.4, and 2025.11.8. The flaw requires authentication (PR:L per CVSS) and only impacts Windows deployments; no public exploit code has been identified at time of analysis. With a CVSS score of 8.8, successful exploitation grants high confidentiality, integrity, and availability impact.
Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings.
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile).
Improper permission enforcement in JetBrains TeamCity before 2026.1.2 lets authenticated low-privilege users modify CI/CD pipelines they should not control, undermining build integrity and potentially exposing pipeline secrets. Reported by JetBrains itself and carrying a CVSS 8.1, the flaw is a missing-authorization issue (CWE-862) rather than a memory-safety bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers.
Information disclosure in JetBrains TeamCity prior to version 2026.1 allows authenticated low-privilege users to read sensitive build configuration parameters they should not have access to due to missing authorization checks. The flaw carries a CVSS 7.6 score driven by high confidentiality impact on a network-reachable CI/CD server, though no public exploit identified at time of analysis. Because TeamCity build parameters frequently contain secrets such as deployment credentials, signing keys, and API tokens, the disclosure can cascade into broader compromise of downstream systems.
Remote code execution in JetBrains TeamCity before 2026.1 allows an authenticated user with project/build configuration rights to run arbitrary code on the CI server by tampering with Perforce (P4) connection settings. The flaw stems from unsafe handling of version-control connection parameters (CWE-88, argument injection), and while it carries a high CVSS of 8.8 with total technical impact, there is no public exploit identified at time of analysis and its EPSS probability is 0.00%.
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Reflected cross-site scripting in JetBrains TeamCity before 2026.1.1 allows an attacker to inject arbitrary script into a victim's browser via the keyword filter parameter, executing in the context of the TeamCity web UI. Because TeamCity is a CI/CD orchestration server holding build secrets and privileged sessions, a tricked authenticated user (e.g. an administrator) clicking a crafted link can have their session or sensitive data compromised. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%).
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrative actions by bypassing authentication controls on specific endpoints. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and carries an EPSS score of 82.47% (99th percentile), placing it among the highest-probability exploitation targets currently tracked.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in JetBrains TeamCity's classic build log allows an authenticated user with permission to inject content into build output to execute arbitrary JavaScript in the browser of another user who views the affected log. The flaw affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8, and exploitation requires both authentication and victim interaction, making it a moderate-severity risk (vendor CVSS 6.7). No public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8 allows an authenticated low-privilege attacker to inject malicious scripts into the classic project overview page, which execute in the context of any user-including higher-privileged administrators-who navigates to that view. The vulnerability requires the attacker to have a valid TeamCity account with rights to store content that renders in the classic overview, and a privileged victim must actively open that legacy view; no public exploit code has been identified at time of analysis. The independent assessment rates the overall risk as conditional rather than critical, noting that instances not exposing the classic overview to low-privilege contributors are not realistically exploitable.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an unauthenticated attacker persist malicious script through the agent registration flow, which then executes in the browser of any privileged user (e.g. an administrator) who later views the affected agent-management interface. Because agent registration requires no authentication, the entry barrier is minimal, and successful execution in an admin session can lead to session/token theft and pivoting to control of a CI/CD build server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an attacker who controls a build agent persist a malicious script into agent-reported data that executes when a privileged user opens the cloud profile page. Because it fires in the browser session of an operator with access to CI/CD configuration, it can lead to session/token theft and actions performed as the victim. The issue was reported by JetBrains itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in JetBrains TeamCity's SAML login page allows a high-privileged attacker to inject persistent malicious scripts that execute in victims' browsers upon visiting the login page. All TeamCity versions prior to 2026.1 are affected. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect browser sessions beyond the immediate component, though confidentiality impact is rated low and no integrity or availability loss is assessed. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Open redirect in JetBrains TeamCity's SAML authentication plugin (all versions before 2026.1) allows a remote unauthenticated attacker to redirect authenticated users to arbitrary external URLs during the SAML login flow. The vulnerability carries a CVSS 3.1 score of 3.1 (Low), reflecting high attack complexity and mandatory user interaction - limiting realistic exploitation to targeted phishing scenarios against TeamCity users leveraging SAML SSO. No public exploit code exists and no active exploitation has been confirmed.
Credential exposure in JetBrains TeamCity before version 2026.1 allows authenticated remote attackers to retrieve sensitive secrets via JVM thread name inspection. The root cause (CWE-522 - Insufficiently Protected Credentials) is TeamCity embedding credential values directly into thread names, which surfaces in thread dumps, monitoring interfaces, and diagnostic tooling accessible to low-privileged users. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) makes it a significant credential theft vector in enterprise CI/CD environments where TeamCity routinely holds access tokens to source repositories, cloud infrastructure, and deployment targets.
Credential parameter exposure in JetBrains TeamCity before version 2026.1 allows authenticated low-privilege users to access sensitive credential values through the parameter autocompletion feature. Rooted in CWE-862 (Missing Authorization), the autocompletion endpoint fails to enforce proper access controls before surfacing credential parameters, potentially leaking secrets such as passwords, tokens, or API keys stored in build configurations. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful lateral movement or privilege escalation risk in multi-tenant CI/CD environments.
Sensitive data exposure in JetBrains TeamCity before 2025.11.2 allows authenticated low-privileged users to read confidential values stored in default build agent parameters. The root cause (CWE-526) indicates that sensitive information - such as API keys, tokens, or credentials - is passed or stored through agent environment/configuration parameters without adequate access restrictions. With a CVSS score of 4.3 and no public exploit or KEV listing, this represents a moderate-priority information disclosure risk, most dangerous in environments where agent parameters are used to propagate secrets across pipelines.
Insufficient username validation in the SAML plugin of JetBrains TeamCity before 2026.1 allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to CI/CD resources. The flaw (CWE-863, Incorrect Authorization) permits manipulation of the username field within SAML assertions, potentially enabling impersonation of legitimate users and unauthorized read/write access to build configurations and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting on the TeamCity repository download page allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The Changed scope (S:C) in the CVSS vector indicates the payload can escape the vulnerable component and affect the victim's broader browser session, enabling session token theft, credential harvesting, or malicious redirects against TeamCity users. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk [CVSS 2.3 LOW]
Insufficient authorization checks in JetBrains TeamCity before version 2025.11.3 permit project developers to modify build configuration parameters without proper access controls. An authenticated attacker with developer privileges could inject malicious parameters into build configurations, potentially altering build behavior or exposing sensitive information. No patch is currently available for this vulnerability.
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Path traversal in JetBrains TeamCity's file-upload handling, affecting versions before 2025.11, lets an attacker supply crafted path sequences to read files outside the intended upload location, exposing sensitive server-side data (C:H/I:N/A:N). The vendor-scored CVSS 3.1 base is 7.5 (AV:N/AC:L/PR:N/UI:N), but our independent assessment flags a discrepancy: the scored vector is unauthenticated (PR:N) while TeamCity's file-upload functionality is generally restricted to authenticated users, so a valid session is the realistic prerequisite and the effective score may be inflated. Exploitation is not confirmed actively exploited (no CISA KEV), no public exploit code exists, and EPSS is low at 0.80% (55th percentile), making near-term risk moderate and largely contingent on whether the vulnerable upload endpoint is reachable.
Stored cross-site scripting in JetBrains TeamCity server builds prior to 2025.11 allows an authenticated user with low-level privileges to plant a malicious script payload in a session attribute, which then executes in the browser of another user who renders the affected content. Exploitation is not fully unauthenticated: it requires a valid low-privilege TeamCity account to stage the payload (PR:L) plus victim interaction (UI:R), and the resulting impact is limited to script execution inside the victim's authenticated browser context with low confidentiality and integrity effects and no availability impact (CVSS 5.4, CWE-79). No public exploit code has been identified at time of analysis, and EPSS places exploitation likelihood at roughly 0.5% (40th percentile), making this a moderate, not top-priority, issue.
Improper access control in JetBrains TeamCity versions before 2025.11 can expose metadata associated with a configured GitHub App token, allowing network attackers to read limited confidential information (CVSS 5.3, C:L only) without affecting integrity or availability. The flaw only matters on servers that actually have a GitHub App integration configured, and the exposure is limited to the token's metadata rather than the token secret itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and there is no CISA KEV listing, so this is a moderate-severity information disclosure issue rather than an urgent, actively exploited threat; the assessed vector shows PR:N, but because the root cause is an authorization defect (CWE-863), defenders should verify whether anonymous access is truly sufficient on their deployment.
Improper repository URL validation in JetBrains TeamCity before 2025.11.2 allows an authenticated user with permission to create or edit a VCS root to disclose local filesystem paths on the TeamCity server. Successful exploitation requires low-privilege credentials (PR:L) and high attack complexity (AC:H) to craft a repository URL that bypasses the server's validation, and the resulting impact is limited to path information exposure - no secrets, write access, or code execution is obtained (CVSS 3.1, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation signals indicate low real-world priority: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership. Rated high severity (CVSS 7.5). No vendor patch available.
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 15.7% and no vendor patch available.
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 19.9% and no vendor patch available.
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-whitelist bypass in the build messages protocol lets a serialized payload cross the deserialization trust boundary and execute code in the server process; the flaw carries a CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, unauthicated per the PR:N vector). There is no public exploit identified at time of analysis, CISA's SSVC records Exploitation as 'none' with Automatable set to 'no', and EPSS is low at 0.38% (31st percentile), though Technical Impact is rated 'total'. JetBrains has released fixes, so the primary risk is unpatched, network-reachable TeamCity servers whose agent-facing build messages channel is exposed beyond trusted build-agent hosts.
Information disclosure in JetBrains TeamCity before 2026.2.1 allows a crafted Git submodule URL to make the server read files from local repositories reachable by the TeamCity service account, exposing source code and other local repository contents. The supplied NVD vector rates this as network-reachable without privileges (PR:N), but our assessment applies a low-privileged precondition (PR:L), because the attacker must be able to influence a submodule URL - typically by committing a malicious .gitmodules file to a repository TeamCity checks out, or by controlling a VCS root - on an instance configured to resolve Git submodules. Impact is confidentiality-only with no integrity or availability effect; EPSS is low (0.62%, 48th percentile), SSVC records no exploitation activity, and no public exploit code has been identified at time of analysis.
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify versioned-settings build configuration code to run arbitrary code on the TeamCity server, breaking out of the DSL evaluation sandbox. The vendor advisory covers TeamCity releases before 2026.1.3 and before 2025.11.7; the CVSS 3.1 vector published with the CVE is a full 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), while our independent assessment scores it lower at PR:L because practical exploitation requires the ability to inject Kotlin DSL - realistically project-administration/edit rights in the TeamCity UI or write/commit access to the VCS repository holding the project's versioned settings - and the Kotlin DSL / versioned settings feature must actually be enabled. Risk signals here are genuinely conflicting and should be read carefully: a maximum-severity scope-changing RCE sits alongside a low EPSS of 0.27% (18th percentile), CISA SSVC 'Exploitation: none' and 'Automatable: no', and no public exploit identified at time of analysis, so this looks more like a high-impact but privilege-gated flaw than a broadly wormable one.
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that permits an unauthenticated remote attacker to take over an administrator account. The vulnerability requires a non-trivial condition (AC:H) related to improper validation of input equivalence (CWE-1289), so exploitation is not fully turnkey. No public exploit code has been identified at the time of analysis, but the high impact (C/I/A:H) and remote, unauthenticated attack vector make this a genuinely high-priority flaw despite thin external signals; upgrading to the specified versions removes the vulnerability.
Command execution on Windows-based JetBrains TeamCity servers allows authenticated users with Pipeline Git connection configuration privileges to run arbitrary OS commands via CRLF injection in connection settings, affecting versions before 2026.2, 2026.1.4, and 2025.11.8. The flaw requires authentication (PR:L per CVSS) and only impacts Windows deployments; no public exploit code has been identified at time of analysis. With a CVSS score of 8.8, successful exploitation grants high confidentiality, integrity, and availability impact.
Remote code execution in JetBrains TeamCity (CVE-2026-100253) lets an authenticated attacker with permission to edit a project's versioned settings escape the Kotlin DSL sandbox and execute code on the TeamCity server. Affected versions are those before 2026.2, before 2026.1.4, and before 2025.11.8. No public exploit identified at time of analysis, but this is a genuine high-priority issue rather than an inflated CVSS score because it can compromise a CI/CD server; exploitation requires a low-privileged, non-anonymous account able to supply or commit malicious Kotlin DSL settings.
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile).
Improper permission enforcement in JetBrains TeamCity before 2026.1.2 lets authenticated low-privilege users modify CI/CD pipelines they should not control, undermining build integrity and potentially exposing pipeline secrets. Reported by JetBrains itself and carrying a CVSS 8.1, the flaw is a missing-authorization issue (CWE-862) rather than a memory-safety bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers.
Information disclosure in JetBrains TeamCity prior to version 2026.1 allows authenticated low-privilege users to read sensitive build configuration parameters they should not have access to due to missing authorization checks. The flaw carries a CVSS 7.6 score driven by high confidentiality impact on a network-reachable CI/CD server, though no public exploit identified at time of analysis. Because TeamCity build parameters frequently contain secrets such as deployment credentials, signing keys, and API tokens, the disclosure can cascade into broader compromise of downstream systems.
Remote code execution in JetBrains TeamCity before 2026.1 allows an authenticated user with project/build configuration rights to run arbitrary code on the CI server by tampering with Perforce (P4) connection settings. The flaw stems from unsafe handling of version-control connection parameters (CWE-88, argument injection), and while it carries a high CVSS of 8.8 with total technical impact, there is no public exploit identified at time of analysis and its EPSS probability is 0.00%.
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Reflected cross-site scripting in JetBrains TeamCity before 2026.1.1 allows an attacker to inject arbitrary script into a victim's browser via the keyword filter parameter, executing in the context of the TeamCity web UI. Because TeamCity is a CI/CD orchestration server holding build secrets and privileged sessions, a tricked authenticated user (e.g. an administrator) clicking a crafted link can have their session or sensitive data compromised. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%).
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrative actions by bypassing authentication controls on specific endpoints. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and carries an EPSS score of 82.47% (99th percentile), placing it among the highest-probability exploitation targets currently tracked.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting (XSS) in JetBrains TeamCity's classic build log allows an authenticated user with permission to inject content into build output to execute arbitrary JavaScript in the browser of another user who views the affected log. The flaw affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8, and exploitation requires both authentication and victim interaction, making it a moderate-severity risk (vendor CVSS 6.7). No public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8 allows an authenticated low-privilege attacker to inject malicious scripts into the classic project overview page, which execute in the context of any user-including higher-privileged administrators-who navigates to that view. The vulnerability requires the attacker to have a valid TeamCity account with rights to store content that renders in the classic overview, and a privileged victim must actively open that legacy view; no public exploit code has been identified at time of analysis. The independent assessment rates the overall risk as conditional rather than critical, noting that instances not exposing the classic overview to low-privilege contributors are not realistically exploitable.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an unauthenticated attacker persist malicious script through the agent registration flow, which then executes in the browser of any privileged user (e.g. an administrator) who later views the affected agent-management interface. Because agent registration requires no authentication, the entry barrier is minimal, and successful execution in an admin session can lead to session/token theft and pivoting to control of a CI/CD build server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an attacker who controls a build agent persist a malicious script into agent-reported data that executes when a privileged user opens the cloud profile page. Because it fires in the browser session of an operator with access to CI/CD configuration, it can lead to session/token theft and actions performed as the victim. The issue was reported by JetBrains itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in JetBrains TeamCity's SAML login page allows a high-privileged attacker to inject persistent malicious scripts that execute in victims' browsers upon visiting the login page. All TeamCity versions prior to 2026.1 are affected. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect browser sessions beyond the immediate component, though confidentiality impact is rated low and no integrity or availability loss is assessed. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Open redirect in JetBrains TeamCity's SAML authentication plugin (all versions before 2026.1) allows a remote unauthenticated attacker to redirect authenticated users to arbitrary external URLs during the SAML login flow. The vulnerability carries a CVSS 3.1 score of 3.1 (Low), reflecting high attack complexity and mandatory user interaction - limiting realistic exploitation to targeted phishing scenarios against TeamCity users leveraging SAML SSO. No public exploit code exists and no active exploitation has been confirmed.
Credential exposure in JetBrains TeamCity before version 2026.1 allows authenticated remote attackers to retrieve sensitive secrets via JVM thread name inspection. The root cause (CWE-522 - Insufficiently Protected Credentials) is TeamCity embedding credential values directly into thread names, which surfaces in thread dumps, monitoring interfaces, and diagnostic tooling accessible to low-privileged users. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) makes it a significant credential theft vector in enterprise CI/CD environments where TeamCity routinely holds access tokens to source repositories, cloud infrastructure, and deployment targets.
Credential parameter exposure in JetBrains TeamCity before version 2026.1 allows authenticated low-privilege users to access sensitive credential values through the parameter autocompletion feature. Rooted in CWE-862 (Missing Authorization), the autocompletion endpoint fails to enforce proper access controls before surfacing credential parameters, potentially leaking secrets such as passwords, tokens, or API keys stored in build configurations. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful lateral movement or privilege escalation risk in multi-tenant CI/CD environments.
Sensitive data exposure in JetBrains TeamCity before 2025.11.2 allows authenticated low-privileged users to read confidential values stored in default build agent parameters. The root cause (CWE-526) indicates that sensitive information - such as API keys, tokens, or credentials - is passed or stored through agent environment/configuration parameters without adequate access restrictions. With a CVSS score of 4.3 and no public exploit or KEV listing, this represents a moderate-priority information disclosure risk, most dangerous in environments where agent parameters are used to propagate secrets across pipelines.
Insufficient username validation in the SAML plugin of JetBrains TeamCity before 2026.1 allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to CI/CD resources. The flaw (CWE-863, Incorrect Authorization) permits manipulation of the username field within SAML assertions, potentially enabling impersonation of legitimate users and unauthorized read/write access to build configurations and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting on the TeamCity repository download page allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The Changed scope (S:C) in the CVSS vector indicates the payload can escape the vulnerable component and affect the victim's broader browser session, enabling session token theft, credential harvesting, or malicious redirects against TeamCity users. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk [CVSS 2.3 LOW]
Insufficient authorization checks in JetBrains TeamCity before version 2025.11.3 permit project developers to modify build configuration parameters without proper access controls. An authenticated attacker with developer privileges could inject malicious parameters into build configurations, potentially altering build behavior or exposing sensitive information. No patch is currently available for this vulnerability.
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Path traversal in JetBrains TeamCity's file-upload handling, affecting versions before 2025.11, lets an attacker supply crafted path sequences to read files outside the intended upload location, exposing sensitive server-side data (C:H/I:N/A:N). The vendor-scored CVSS 3.1 base is 7.5 (AV:N/AC:L/PR:N/UI:N), but our independent assessment flags a discrepancy: the scored vector is unauthenticated (PR:N) while TeamCity's file-upload functionality is generally restricted to authenticated users, so a valid session is the realistic prerequisite and the effective score may be inflated. Exploitation is not confirmed actively exploited (no CISA KEV), no public exploit code exists, and EPSS is low at 0.80% (55th percentile), making near-term risk moderate and largely contingent on whether the vulnerable upload endpoint is reachable.
Stored cross-site scripting in JetBrains TeamCity server builds prior to 2025.11 allows an authenticated user with low-level privileges to plant a malicious script payload in a session attribute, which then executes in the browser of another user who renders the affected content. Exploitation is not fully unauthenticated: it requires a valid low-privilege TeamCity account to stage the payload (PR:L) plus victim interaction (UI:R), and the resulting impact is limited to script execution inside the victim's authenticated browser context with low confidentiality and integrity effects and no availability impact (CVSS 5.4, CWE-79). No public exploit code has been identified at time of analysis, and EPSS places exploitation likelihood at roughly 0.5% (40th percentile), making this a moderate, not top-priority, issue.
Improper access control in JetBrains TeamCity versions before 2025.11 can expose metadata associated with a configured GitHub App token, allowing network attackers to read limited confidential information (CVSS 5.3, C:L only) without affecting integrity or availability. The flaw only matters on servers that actually have a GitHub App integration configured, and the exposure is limited to the token's metadata rather than the token secret itself. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and there is no CISA KEV listing, so this is a moderate-severity information disclosure issue rather than an urgent, actively exploited threat; the assessed vector shows PR:N, but because the root cause is an authorization defect (CWE-863), defenders should verify whether anonymous access is truly sufficient on their deployment.
Improper repository URL validation in JetBrains TeamCity before 2025.11.2 allows an authenticated user with permission to create or edit a VCS root to disclose local filesystem paths on the TeamCity server. Successful exploitation requires low-privilege credentials (PR:L) and high attack complexity (AC:H) to craft a repository URL that bypasses the server's validation, and the resulting impact is limited to path information exposure - no secrets, write access, or code execution is obtained (CVSS 3.1, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation signals indicate low real-world priority: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership. Rated high severity (CVSS 7.5). No vendor patch available.
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 15.7% and no vendor patch available.
In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 19.9% and no vendor patch available.
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.