In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible

In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS

In JetBrains TeamCity before 2021.1.2, stored XSS is possible

In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible

In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata

In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs

In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings

In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection

In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposed

In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation

In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed

In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases

In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning

In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings

In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive

In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable

In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server

In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie

In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project

In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient

In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing

In JetBrains TeamCity before 2021.1.2, user enumeration was possible

In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made

In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used

In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly

In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly

In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration

In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts

In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances

The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts

In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission

In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources…

In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible

In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project

An issue was discovered in JetBrains TeamCity 2018.2.4

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page