In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible

In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible

In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page

In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab

In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log

In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page

In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page

In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs

In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible

In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab