CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| HIGH7.1 |
In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
| 28/04/2022 |
| CVE-2022-29817 | MEDIUM6.1 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible | 28/04/2022 |
| CVE-2022-29816 | LOW3.2 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible | 28/04/2022 |
| CVE-2022-29815 | MEDIUM6.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible | 28/04/2022 |
| CVE-2022-29814 | HIGH7.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible | 28/04/2022 |
| CVE-2022-29813 | MEDIUM6.7 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible | 28/04/2022 |
| CVE-2022-29812 | LOW2.3 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient | 28/04/2022 |
| CVE-2022-29811 | MEDIUM4.8 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. | 28/04/2022 |
| CVE-2022-29035 | LOW2.7 | In JetBrains Ktor Native before version 2.0.0 random values used for nonce generation weren't using SecureRandom implementations | 11/04/2022 |
| CVE-2022-28651 | MEDIUM5.5 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields | 05/04/2022 |
| CVE-2022-28650 | MEDIUM5.4 | In JetBrains YouTrack before 2022.1.43700 it was possible to inject JavaScript into Markdown in the YouTrack Classic UI | 05/04/2022 |
| CVE-2022-28649 | MEDIUM5.4 | In JetBrains YouTrack before 2022.1.43563 it was possible to include an iframe from a third-party domain in the issue description | 05/04/2022 |
| CVE-2022-28648 | MEDIUM5.4 | In JetBrains YouTrack before 2022.1.43563 HTML code from the issue description was being rendered | 05/04/2022 |
| CVE-2022-25264 | HIGH7.5 | In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. | 25/02/2022 |
| CVE-2022-25263 | CRITICAL9.8 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. | 25/02/2022 |
| CVE-2022-25262 | CRITICAL9.8 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | 25/02/2022 |