Jetbrains : Security Vulnerabilities, CVEs, Published In October 2019

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.

In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the corresponding permissions.

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters and data" permission.

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration under some circumstances.

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code execution.

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability.

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere.

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.

An issue was discovered in JetBrains TeamCity 2018.2.4. The TeamCity server was not using some security-related HTTP headers. The issue was fixed in TeamCity 2019.1.

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.

An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could execute any command on the server machine. The issue was fixed in TeamCity 2018.2.5 and 2019.1.

An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially confidential server-level data. The issue was fixed in TeamCity 2018.2.5 and 2019.1.

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.

JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.

JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. In a very specific situation, it could lead to a remote invocation of an OOM error message because of Uncontrolled Memory Allocation.

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository.