Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2024-35301MEDIUMIn JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App tokenEPSS 0.3%CVE-2026-123326HIGHIn JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspensionEPSS 0.3%CVE-2026-57923MEDIUMIn JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settingsEPSS 0.3%CVE-2026-123289MEDIUMIn JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify filesEPSS 0.3%CVE-2026-100260MEDIUMIn JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password resetEPSS 0.3%CVE-2026-86486LOWIn JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blankEPSS 0.3%CVE-2026-49371HIGHIn JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possibleEPSS 0.3%CVE-2022-47896MEDIUMIn JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.EPSS 0.3%CVE-2022-40978HIGHThe installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingEPSS 0.3%CVE-2026-49386MEDIUMIn JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning CanvasEPSS 0.3%CVE-2026-49379MEDIUMIn JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesEPSS 0.3%CVE-2026-103490HIGHIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksEPSS 0.3%CVE-2026-41153MEDIUMIn JetBrains Junie before 252.549.29 command execution was possible via malicious project fileEPSS 0.3%CVE-2026-123857MEDIUMIn JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionEPSS 0.3%CVE-2026-123846MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validationEPSS 0.3%CVE-2025-43015HIGHIn JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfacesEPSS 0.3%CVE-2024-36371MEDIUMIn JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possibleEPSS 0.3%CVE-2025-54532MEDIUMIn JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependenciesEPSS 0.3%CVE-2026-123839MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwardingEPSS 0.3%CVE-2022-37009LOWIn JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possibleEPSS 0.3%