Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.
2025(2)
CVE-2025-244604.3In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
CVE-2025-244594.6In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
2024(63)
CVE-2024-563565.9In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-563554.6In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
CVE-2024-563545.5In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
CVE-2024-563535.5In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
CVE-2024-563524.6In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
CVE-2024-563516.3In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
CVE-2024-563504.3In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
CVE-2024-563495.3In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
CVE-2024-563484.3In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
CVE-2024-479513.5In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
CVE-2024-479503.5In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
CVE-2024-479494.9In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
CVE-2024-479484.9In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
CVE-2024-471614.3In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
CVE-2024-438104.6In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
CVE-2024-438093.5In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
CVE-2024-438083.7In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
CVE-2024-438074.6In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
CVE-2024-431147.5In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
CVE-2024-418293.5In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection
CVE-2024-418282.6In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
CVE-2024-418277.4In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
CVE-2024-418263.5In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page
CVE-2024-418254.6In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab
CVE-2024-418246.4In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
CVE-2024-398795.0In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings
CVE-2024-398784.1In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection
CVE-2024-364708.1In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases
CVE-2024-363785.9In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens
CVE-2024-363776.5In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions
CVE-2024-363766.5In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissions
CVE-2024-363755.3In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed
CVE-2024-363744.6In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possible
CVE-2024-363734.6In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
CVE-2024-363724.6In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possible
CVE-2024-363714.6In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possible
CVE-2024-363704.6In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible
CVE-2024-363694.6In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possible
CVE-2024-363684.6In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible
CVE-2024-363674.6In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possible
CVE-2024-363665.4In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering operations
CVE-2024-363656.8In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
CVE-2024-363646.5In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible
CVE-2024-363634.6In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possible
CVE-2024-363626.5In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was possible
CVE-2024-353025.4In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible
CVE-2024-353015.5In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token
CVE-2024-311404.1In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools
CVE-2024-311395.9In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVE-2024-311384.6In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
CVE-2024-311376.8In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration
CVE-2024-311367.4In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter
CVE-2024-311356.1In JetBrains TeamCity before 2024.03 open redirect was possible on the login page
CVE-2024-311346.5In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled
CVE-2024-298804.2In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process
CVE-2024-281745.8In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly
CVE-2024-271997.3In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
CVE-2024-271989.8In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
CVE-2024-249425.3In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
CVE-2024-249385.3In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
CVE-2024-249374.6In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
CVE-2024-249364.3In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
CVE-2024-239179.8In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
2023(1)
CVE-2023-508704.3In JetBrains TeamCity before 2023.11.1 a CSRF on login was possible