Threat database

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata

EPSS 0.2%VulnerabilityJetBrains#cwe-863Germany+4

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure

EPSS 0.2%VulnerabilityJetBrains#cwe-939Germany+6

In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit

EPSS 0.2%VulnerabilityJetBrains#cwe-362Germany+5

In JetBrains ReSharper, Rider and dotTrace before 2025.2.5 local privilege escalation was possible via race condition

EPSS <0.1%VulnerabilityJetBrains#cwe-367United States+9

In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation

EPSS <0.1%VulnerabilityJetBrains#cwe-347United States+9

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

EPSS 0.2%VulnerabilityJetBrains#cwe-295United States+9

In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form

EPSS 0.3%VulnerabilityJetBrains#cwe-862Germany+6

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

EPSS 0.2%VulnerabilityJetBrains#cwe-362Germany+5

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

EPSS 0.2%VulnerabilityJetBrains#cwe-362Germany+4

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

EPSS 0.2%VulnerabilityJetBrains#cwe-862Germany+5

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation

EPSS 0.5%VulnerabilityJetBrains#cwe-77Germany+9

In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

EPSS 0.8%VulnerabilityJetBrains#cwe-183Germany+7

In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload

EPSS 13%VulnerabilityJetBrains#cwe-23Germany+7

In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition

EPSS 0.4%VulnerabilityJetBrains#cwe-362Germany+4

The Contagious Interview campaign is a coordinated cyber espionage operation by North Korean threat actors, notably linked to the Lazarus group, targeting the cryptocurrency sector. These actors actively monitor cyber threat intelligence platforms such as Validin, VirusTotal, and Maltrail to identify exposed infrastructure and new targets. They prioritize rapid deployment of malicious infrastructure over stealth and use social engineering techniques, including the ClickFix method, to trick victims into executing malware. Between January and March 2025, over 230 victims were engaged, demonstrating the campaign's scale and sophistication. Although no known exploits for CVE-2023-42793 have been observed in the wild, the campaign poses a medium severity threat. European cryptocurrency organizations, especially in countries with significant crypto markets and financial sectors, are at risk. Mitigation requires targeted monitoring of threat intelligence platforms, enhanced user training against social engineering, and rapid incident response capabilities.

KEVEPSS 99%CampaignJetBrains#cyber espionage#social engineeringGermany+6