In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page

In JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possible

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool

In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects

In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents

In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user

In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records

In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have

In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages

A user without the required permissions could gain access to some JetBrains TeamCity settings

In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition

In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users

Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Permissions

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test

In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration

In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file

In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to…

Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors