CVE-2024-29880

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

VendorProductVersions
JetBrainsTeamCity< 2023.11
jetbrainsteamcity< 2023.11

References

Timeline

Published
Mar 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-298816.1TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and contCVE-2024-298826.1SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callCVE-2024-298834.9CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and alCVE-2024-298854.3silverstripe/reports is an API for creating backend reports in the Silverstripe Framework. In affected versions reports can be accessed by tCVE-2024-298865.3Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm tCVE-2024-298877.4Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all noCVE-2024-298885.4Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery meCVE-2024-298898.1GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability iCVE-2024-29898.8A vulnerability, which was classified as critical, has been found in Tenda FH1203 2.0.1.6. Affected by this issue is the function fromNatStaCVE-2024-298908.8DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart tyCVE-2024-298918.7ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML aCVE-2024-298924.9ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action cou
CVE-2024-29880: High severity, CVSS 7.8 | Vulnix