Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2024-36365MEDIUMIn JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agentEPSS 0.3%CVE-2024-39878MEDIUMIn JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App ConnectionEPSS 0.3%CVE-2026-28193HIGHIn JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpointEPSS 0.3%CVE-2026-123323HIGHIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to sendEPSS 0.3%CVE-2025-57733MEDIUMIn JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email contentEPSS 0.3%CVE-2025-24460MEDIUMIn JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent poolEPSS 0.3%CVE-2026-86496MEDIUMIn JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addressesEPSS 0.3%CVE-2026-123282HIGHIn JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated sessionEPSS 0.3%CVE-2022-46828MEDIUMIn JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.EPSS 0.3%CVE-2026-123328MEDIUMIn JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tabEPSS 0.3%CVE-2026-111092MEDIUMIn JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-projectEPSS 0.3%CVE-2024-24940LOWIn JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesEPSS 0.3%CVE-2024-35299MEDIUMIn JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validationEPSS 0.3%CVE-2026-57925MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tagsEPSS 0.3%CVE-2026-118696HIGHIn JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026EPSS 0.3%CVE-2026-123325HIGHIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandEPSS 0.3%CVE-2026-123307MEDIUMIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possibleEPSS 0.3%CVE-2026-123844MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositoriesEPSS 0.3%CVE-2026-57924MEDIUMIn JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile detailsEPSS 0.3%CVE-2026-123300LOWIn JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappingsEPSS 0.3%