In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.

In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over the network. This issue was fixed in 2019.3.

JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.

In JetBrains YouTrack before 2019.2.59309, SMTP/Jabber settings could be accessed using backups.

In JetBrains TeamCity before 2019.2, several user-level pages were vulnerable to XSS.

JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.

In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.

In JetBrains TeamCity before 2019.1.5, reverse tabnabbing was possible on several pages.

In the JetBrains Scala plugin before 2019.2.1, some artefact dependencies were resolved over unencrypted connections.

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. This issue was fixed in release version 2019.3.

Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.

In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.

Request smuggling is possible in Ktor when both chunked TE and content length specified

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.

In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.