In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration

In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.

In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.

In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.

In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.

In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.

In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.

JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.

In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve the Remote Code Execution.

In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible