Vulnerabilities > Jetbrains > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-02-25 | CVE-2022-25261 | Cross-site Scripting vulnerability in Jetbrains Teamcity JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. | 4.3 |
| 2022-02-25 | CVE-2022-25264 | Insecure Storage of Sensitive Information vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. | 5.0 |
| 2022-02-25 | CVE-2022-24327 | Incorrect Permission Assignment for Critical Resource vulnerability in Jetbrains HUB In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. | 5.0 |
| 2022-02-25 | CVE-2022-24328 | Unspecified vulnerability in Jetbrains HUB In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. | 4.0 |
| 2022-02-25 | CVE-2022-24329 | Improper Locking vulnerability in multiple products In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. | 5.3 |
| 2022-02-25 | CVE-2022-24330 | Open Redirect vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. | 5.8 |
| 2022-02-25 | CVE-2022-24332 | Insufficient Session Expiration vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie. | 5.0 |
| 2022-02-25 | CVE-2022-24333 | Server-Side Request Forgery (SSRF) vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. | 4.0 |
| 2022-02-25 | CVE-2022-24334 | Unspecified vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server. | 5.0 |
| 2022-02-25 | CVE-2022-24335 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Jetbrains Teamcity JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC. | 6.8 |