Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2024-24941MEDIUMIn JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URLEPSS 0.3%CVE-2022-48342MEDIUMIn JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.EPSS 0.3%CVE-2024-38506MEDIUMIn JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsEPSS 0.3%CVE-2024-56353MEDIUMIn JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookiesEPSS 0.3%CVE-2026-123279CRITICALIn JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaboratorsEPSS 0.3%CVE-2024-43807MEDIUMIn JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds pageEPSS 0.3%CVE-2024-47161MEDIUMIn JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST APIEPSS 0.3%CVE-2024-56351MEDIUMIn JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user rolesEPSS 0.3%CVE-2024-24936MEDIUMIn JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missedEPSS 0.3%CVE-2024-56354MEDIUMIn JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permissionEPSS 0.3%CVE-2026-100273HIGHIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionEPSS 0.3%CVE-2026-86493MEDIUMIn JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cardsEPSS 0.3%CVE-2026-86494HIGHIn JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issuesEPSS 0.3%CVE-2026-86498HIGHIn JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without upEPSS 0.3%CVE-2026-57921MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpointEPSS 0.3%CVE-2026-49372HIGHIn JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possibleEPSS 0.3%CVE-2026-123834HIGHIn JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountEPSS 0.3%CVE-2024-41824MEDIUMIn JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific casesEPSS 0.3%CVE-2024-41826LOWIn JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection pageEPSS 0.3%CVE-2025-24456MEDIUMIn JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mappingEPSS 0.3%