Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
285 results · page 6 of 6
Aug 8, 2020In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.CVE-2020-15829 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.CVE-2020-15828 · Other software · Jetbrains · reported by MITREMedium 6.5
In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.CVE-2020-15826 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 8, 2020In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.CVE-2020-15825 · Other software · Jetbrains · reported by MITREHigh 8.8
In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project.CVE-2020-11938 · Other software · Jetbrains · reported by MITREMedium 4.9
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.CVE-2020-11689 · Other software · Jetbrains · reported by MITREMedium 6.5
In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.CVE-2020-11688 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.CVE-2020-11687 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Apr 22, 2020In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.CVE-2020-11686 · Other software · Jetbrains · reported by MITRELow 2.7
In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.CVE-2020-7911 · Other software · Jetbrains · reported by MITREMedium 6.1
In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.CVE-2020-7910 · Other software · Jetbrains · reported by MITREMedium 5.4
JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.CVE-2020-7909 · Other software · Jetbrains · reported by MITREHigh 7.5
In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 30, 2020In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.CVE-2020-7908 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.CVE-2019-18367 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.CVE-2019-18366 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.CVE-2019-18365 · Other software · Jetbrains · reported by MITREMedium 4.3
In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.CVE-2019-18364 · Other software · Jetbrains · reported by MITRECritical 9.8
In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 31, 2019In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.CVE-2019-18363 · Other software · Jetbrains · reported by MITREMedium 5.3
In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15037 · Other software · Jetbrains · reported by MITREMedium 6.1
An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15036 · Other software · Jetbrains · reported by MITREHigh 7.2
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.CVE-2019-12157 · Other software · Jetbrains · reported by MITRECritical 9.8
In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 2, 2019Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.CVE-2019-12156 · Other software · Jetbrains · reported by MITREMedium 5.3
Server metadata could be exposed because one of the error messages reflected the whole response back to the client in JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293.
- Product
- Upsource
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15035 · Other software · Jetbrains · reported by MITREMedium 4.9
An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15042 · Other software · Jetbrains · reported by MITREHigh 7.5
An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15038 · Other software · Jetbrains · reported by MITREHigh 7.5
An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Oct 1, 2019An issue was discovered in JetBrains TeamCity 2018.2.4.CVE-2019-15039 · Other software · Jetbrains · reported by MITRECritical 9.8
An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comblog.jetbrains.com
Sep 5, 2019JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server CVE-2019-15848 · Other software · Jetbrains · reported by MITREMedium 6.1
JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbitrary HTTP request to a TeamCity server under the name of the currently logged-in user.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comgist.github.com
Jul 3, 2019A user without the required permissions could gain access to some JetBrains TeamCity settings.CVE-2019-12846 · Other software · Jetbrains · reported by MITREMedium 4.3
A user without the required permissions could gain access to some JetBrains TeamCity settings. The issue was fixed in TeamCity 2018.2.2.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts.CVE-2019-12845 · Other software · Jetbrains · reported by MITREMedium 5.3
The generated Kotlin DSL settings allowed usage of an unencrypted connection for resolving artifacts. The issue was fixed in JetBrains TeamCity 2018.2.3.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages.CVE-2019-12844 · Other software · Jetbrains · reported by MITREMedium 6.1
A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019A possible stored JavaScript injection requiring a deliberate server administrator action was detected.CVE-2019-12843 · Other software · Jetbrains · reported by MITREMedium 6.1
A possible stored JavaScript injection requiring a deliberate server administrator action was detected. The issue was fixed in JetBrains TeamCity 2018.2.3.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages.CVE-2019-12842 · Other software · Jetbrains · reported by MITREMedium 6.1
A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jul 3, 2019Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity.CVE-2019-12841 · Other software · Jetbrains · reported by MITREHigh 7.5
Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Jan 13, 2015Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parCVE-2014-10036 · Other software · Jetbrains · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to inject arbitrary web script or HTML via the cameFromUrl parameter to feed/generateFeedUrl.html.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.jetbrains.comsecunia.com
Jan 13, 2015Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.CVE-2014-10002 · Other software · Jetbrains · reported by MITREMedium 5
Unspecified vulnerability in JetBrains TeamCity before 8.1 allows remote attackers to obtain sensitive information via unknown vectors.
- Product
- Teamcity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.jetbrains.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.