JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC

In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page

In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups

In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokens

In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers

In JetBrains TeamCity before 2023.05 a specific endpoint was vulnerable to brute force attacks

In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters

In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings

In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases

In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user

In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible

In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS

In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange

In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible

In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible

In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters

JetBrains TeamCity Plugin before 2020.2.85695 SSRF

In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session

In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages

In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI

An issue was discovered in JetBrains TeamCity 2018.2.4

An issue was discovered in JetBrains TeamCity 2018.2.4

Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity

In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter

An issue was discovered in JetBrains TeamCity 2018.2.4

In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token

In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log

In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint

In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies

In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time

In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases