| CVE-2022-48433 | ALTO7.5 | In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. | 29/03/2023 |
| CVE-2022-48432 | ALTO8.8 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. | 29/03/2023 |
| CVE-2022-48431 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation. | 29/03/2023 |
| CVE-2022-48430 | ALTO7.5 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. | 29/03/2023 |
| CVE-2022-48428 | MEDIO5.4 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible | 27/03/2023 |
| CVE-2022-48427 | MEDIO5.4 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible | 27/03/2023 |
| CVE-2022-48429 | MEDIO5.4 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
| 27/03/2023 |
| CVE-2022-48426 | MEDIO5.4 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible | 27/03/2023 |
| CVE-2022-48344 | MEDIO6.1 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process. | 23/02/2023 |
| CVE-2022-48343 | MEDIO6.1 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. | 23/02/2023 |
| CVE-2022-48342 | CRITICO9.8 | In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. | 23/02/2023 |
| CVE-2022-47896 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. | 22/12/2022 |
| CVE-2022-47895 | ALTO7.5 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. | 22/12/2022 |
| CVE-2022-46831 | MEDIO4.9 | In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators. | 08/12/2022 |
| CVE-2022-46830 | MEDIO5.3 | In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning. | 08/12/2022 |
| CVE-2022-46829 | ALTO8.8 | In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented. | 08/12/2022 |
| CVE-2022-46828 | ALTO7.8 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. | 08/12/2022 |
| CVE-2022-46827 | MEDIO5.5 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. | 08/12/2022 |
| CVE-2022-46826 | MEDIO5.5 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability. | 08/12/2022 |
| CVE-2022-46825 | BASSO3.3 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. | 08/12/2022 |