Note: the device may not be impacted by all of these issues. The vulnerabilities are implied based on the software and version.
2025(2)
CVE-2025-244604.3In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
CVE-2025-244594.6In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
2024(14)
CVE-2024-563565.9In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-563554.6In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
CVE-2024-563545.5In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
CVE-2024-563535.5In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
CVE-2024-563524.6In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
CVE-2024-563516.3In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
CVE-2024-563504.3In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
CVE-2024-563495.3In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
CVE-2024-563484.3In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
CVE-2024-479513.5In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
CVE-2024-479503.5In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
CVE-2024-479494.9In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
CVE-2024-479484.9In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
CVE-2024-471614.3In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API