Vulnerabilidades em JetBrains

545 resultados
Análise Vexday

Com 325 CVEs catalogadas e 3 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos JetBrains é 2 vezes acima da média geral do catálogo, o que indica risco operacional elevado mesmo com volume absoluto relativamente contido. A CVE mais crítica em exploração ativa, CVE-2024-27199, apresenta EPSS de 0,9999 — valor praticamente máximo, sinalizando altíssima probabilidade de exploração em ambientes reais e exigindo atenção imediata de equipes de resposta. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode facilitar comprometimento de sessões e movimentação lateral em ambientes de desenvolvimento. Os 29 CVEs surgidos nos últimos 90 dias e a presença de 4 com PoC pública reforçam a necessidade de ciclos ágeis de patching para produtos desta família.

CVE-2022-48481MEDIUMIn JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possibleEPSS 0.2%CVE-2025-54535MEDIUMIn JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithmsEPSS 0.2%CVE-2026-100257MEDIUMIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF exportEPSS 0.2%CVE-2026-49368HIGHIn JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possibleEPSS 0.2%CVE-2025-68268MEDIUMIn JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageEPSS 0.2%CVE-2026-49375MEDIUMIn JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageEPSS 0.2%CVE-2026-49369MEDIUMIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pagesEPSS 0.2%CVE-2026-123317HIGHIn JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookiesEPSS 0.2%CVE-2026-100269MEDIUMIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassedEPSS 0.2%CVE-2026-123848HIGHIn JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesEPSS 0.2%CVE-2026-123306HIGHIn JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsEPSS 0.2%CVE-2026-103491MEDIUMIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issuesEPSS 0.2%CVE-2025-64681LOWIn JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitationsEPSS 0.2%CVE-2022-46827LOWIn JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.EPSS 0.2%CVE-2025-42921MEDIUMIn JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginEPSS 0.2%CVE-2026-123840MEDIUMIn JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsEPSS 0.2%CVE-2025-68166MEDIUMIn JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tabEPSS 0.2%CVE-2026-32229MEDIUMIn JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabledEPSS 0.2%CVE-2026-123333LOWIn JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprintsEPSS 0.2%CVE-2022-37396MEDIUMIn JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code executionEPSS 0.2%