JetBrains ≫ Teamcity

In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed

In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible