CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

java/intellij2020.2.3_5

IntelliJ IDEA Community Edition

Maintainer
vishwin@FreeBSD.org
Packages
intellij 2020.2.3_5
Upstream
Higher version available: 2026.2.3
CPE
jetbrains:intellij_idea from the port
WWW
https://www.jetbrains.com/idea/
Links
cgit · VuXML

Unaddressed (60) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-6481210.0published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

CVE-2026-6481310.0published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

CVE-2026-597929.6published 2026-07-10

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVE-2024-370519.3published 2024-06-10

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 …

CVE-2026-648148.6published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

CVE-2022-286518.4published 2022-04-05

In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields

CVE-2026-648158.1published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

CVE-2026-493678.0published 2026-05-29

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

CVE-2026-1002567.8published 2026-09-30

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

CVE-2026-750567.8published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

CVE-2026-648117.8published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

CVE-2026-493667.8published 2026-05-29

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

CVE-2022-243467.8published 2022-02-25

In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.

CVE-2022-243457.8published 2022-02-25

In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.

CVE-2021-292637.8published 2021-05-11

In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.

CVE-2021-257587.8published 2021-02-03

In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.

CVE-2022-409787.5published 2022-09-19

The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking

CVE-2021-305047.5published 2021-05-11

In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.

CVE-2021-300067.5published 2021-05-11

In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.

CVE-2022-298146.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible

CVE-2022-298156.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible

CVE-2022-298136.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible

CVE-2022-298196.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible

CVE-2025-577286.5published 2025-08-20

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

CVE-2025-577296.5published 2025-08-20

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

CVE-2026-750546.3published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

CVE-2023-516556.3published 2023-12-21

In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration

CVE-2026-750576.2published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

CVE-2022-468266.2published 2022-12-08

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.

CVE-2024-249416.1published 2024-02-06

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL

CVE-2022-484336.1published 2023-03-29

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

CVE-2022-468245.6published 2022-12-08

In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.

CVE-2026-750585.5published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

CVE-2026-750555.5published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

CVE-2022-484305.5published 2023-03-29

In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.

CVE-2026-750535.4published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

CVE-2025-682695.4published 2025-12-16

In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH

CVE-2025-577305.2published 2025-08-20

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

CVE-2023-392615.2published 2023-07-26

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions

CVE-2022-484325.2published 2023-03-29

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.

CVE-2022-468285.2published 2022-12-08

In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.

CVE-2022-478965.0published 2022-12-22

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.

CVE-2025-577274.7published 2025-08-20

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

CVE-2022-478954.7published 2022-12-22

In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.

CVE-2026-493824.5published 2026-05-29

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

CVE-2022-484314.5published 2023-03-29

In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.

CVE-2026-648104.3published 2026-07-23

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

CVE-2022-468254.0published 2022-12-08

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.

CVE-2022-468273.9published 2022-12-08

In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

CVE-2022-370093.9published 2022-07-28

In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible

CVE-2022-298183.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed

CVE-2022-298173.9published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible

CVE-2026-750523.6published 2026-08-17

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

CVE-2022-370103.6published 2022-07-28

In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed

CVE-2026-493833.3published 2026-05-29

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVE-2024-469703.3published 2024-09-16

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible

CVE-2023-380693.3published 2023-07-12

In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases

CVE-2024-249402.8published 2024-02-06

In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives

CVE-2022-298162.8published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible

CVE-2022-298122.3published 2022-04-28

In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (98)

Ronald Klop (ronald) · 2020.2.3_5
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 2020.2.3_4
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Muhammad Moinur Rahman (bofh) · 2020.2.3_3
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Charlie Li (vishwin) · 2020.2.3_3
java/intellij: move man pages to share/man
9632fe174e
Charlie Li (vishwin) · 2020.2.3_2
Revert "java/intellij: Move man pages to share/man"

Apart from the share/man move, the plist fix was not correct:

pkg-static: Unable to access file /wrkdirs/usr/ports/java/intellij/work/stage/usr/local/share/intellij/lib/commons-lang3-3.11.jar:No such file or directory

The above listed file has nothing to do with Python. Additional
files added were also incorrect. Packaging fails as a result.

The share/man move will be restored in a later commit after getting
some sleep.

This reverts commit e71303202ab8b168f9bc05e204d60261c99c56b1.
4b135fdd29
Nuno Teixeira (eduardo) · 2020.2.3_1
java/intellij: Move man pages to share/man

While here, fix plist

Approved by:	portmgr (blanket)
e71303202a
Stefan Eßer (se) · 2020.2.3
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 2020.2.3
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Charlie Li (vishwin) · 2020.2.3
java/intellij: take maintainership

Approved by: mentors (implicit)
ce75f0f99f
Rene Ladan (rene) · 2020.2.3
all: return bsam's ports to the pool after his commit bit got safekept
65e2c3c3bb
Stefan Eßer (se) · 2020.2.3
Fix CONFLICTS entries of multiple ports

There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.

This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.

Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
cannot conflict with itself (due to logic in bsd.port.mk that
supresses the pattern match result in that case).

A few ports that set the conflicts variables depending on complex
conditions (e.g. port options), have been left unmodified, despite
probably containing outdated package names.

These changes should only affect the installation of locally built
ports, not the package building with poudriere. They should give an
early indication of the install conflict in cases where currently
the pkg command aborts an installation when it detects that an
existing file would be overwritten,

Approved by:	portmgr (implicit)
bcaf25a8c8
Stefan Eßer (se) · 2020.2.3
*/*: Remove redundant '-*' from CONFLICTS definitions

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Approved by: portmgr (blanket)
04b9da4140
Stefan Eßer (se) · 2020.2.3
java/intellij: Add CPE information

Approved by:    portmgr (blanket)
70f6a3fd1b
Tobias Kortkamp (tobik) · 2020.2.3
Remove my useless "Created by" lines
c204633ca0
Mathieu Arnold (mat) · 2020.2.3
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 2020.2.3
Remove # $FreeBSD$ from Makefiles.
305f148f48
Boris Samorodov (bsam) · 2020.2.3
java/intellij: Update to version 2020.2.3.
6e14d609a5
Boris Samorodov (bsam) · 2020.2.2
java/intellij: Update to version 2020.2.2.
99825164d4
Boris Samorodov (bsam) · 2020.2.1
java/intellij: Update to version 2020.2.1.
142324ac1a
Boris Samorodov (bsam) · 2020.2
java/intellij: Update to version 2020.2.
d8f7167be5
Boris Samorodov (bsam) · 2020.1.4
java/intellij: Update to version 2020.1.4.
c16491579d
Boris Samorodov (bsam) · 2020.1.3
java/intellij: Update to version 2020.1.3.
676bdc4146
Boris Samorodov (bsam) · 2020.1.2
java/intellij: Remove superfluous PYTHON_VER at the plist.
f2605465d5
Boris Samorodov (bsam) · 2020.1.2
java/intellij: Update to version 2020.1.2.
9093827413
Boris Samorodov (bsam) · 2020.1.1
java/intellij: Update to version 2020.1.1.
29651ff99e
Boris Samorodov (bsam) · 2020.1
java/intellij: Update to version 2020.1.
31b014f2f3
Boris Samorodov (bsam) · 2019.3.3
java/intellij: Update to version 2019.3.3.
e00b17b1d8
Boris Samorodov (bsam) · 2019.3.2
java/intellij: Update to version 2019.3.2.
dd41c8cec6
Boris Samorodov (bsam) · 2019.3.1
java/intellij: Update to version 2019.3.1.
08b9f52ea1
Greg Lewis (glewis) · 2019.3
Fix packing list

The versions of the Apache Commons Net and Maven JARs are not related to
the Python version.

PR:		242327
Approved by:	bsam@ (maintainer)
96223a0b12
Boris Samorodov (bsam) · 2019.3
java/intellij: Update to version 2019.3.
6c1a63c2f4
Boris Samorodov (bsam) · 2019.2.4
java/intellij: Update to version 2019.2.4.
b93f1fea02
Boris Samorodov (bsam) · 2019.2.3
java/intellij: Update to version 2019.2.3.

PR:		240800
Submitted by:	glewis
b2adbfe1e0
Boris Samorodov (bsam) · 2019.2.2
java/intellij: Update to version 2019.2.2.
23b3213627
Boris Samorodov (bsam) · 2019.2.1
java/intellij: Update to 2019.2.1 and more

PR:	240080
Submitted by: 	Dmitry Wagin <dmitry.wagin@ya.ru>

. update to 2019.2.1
. drop dependency on intellij-pt4j port -- the FreeBSD native library is already included in the upstream pty4j jar
. install FreeBSD native library for jansi
. fix the "Typeahead timeout is exceeded" error
. small cleanup
dcdfcabb7c
Mathieu Arnold (mat) · 2019.2
Convert to UCL & cleanup pkg-message (categories h-k)
3bd0ac0d72
Boris Samorodov (bsam) · 2019.2
java/intellij: Update to version 2019.2.

PR:		239790
Submitted by:	Dmitry Wagin <dmitry.wagin@ya.ru>
5b6ab3983b
Boris Samorodov (bsam) · 2019.1.3
java/intellij: Update to version 2019.1.3.
51507edbb2
Boris Samorodov (bsam) · 2019.1.1
java/intellij: Update to version 2019.1.1
45a674d5ad
Antoine Brodin (antoine) · 2019.1
Fix plist
bc543f67e8
Boris Samorodov (bsam) · 2019.1
java/intellij: Update to version 2019.1
4fcd29306f
Boris Samorodov (bsam) · 2018.3.5
java/intellij: Update to version 2018.3.5
0662b7e26a
Antoine Brodin (antoine) · 2018.3.4
Fix packaging with DEFAULT_VERSIONS=python=3.6

PR:		234633
877ec9fc25
Boris Samorodov (bsam) · 2018.3.4
java/intellij: Update to version 2018.3.4
77db64db81
Boris Samorodov (bsam) · 2018.3.3
java/intellij: Update to version 2018.3.3
b986f7f8e6
Boris Samorodov (bsam) · 2018.3.2
java/intellij: Update to version 2018.3.2
278de811ba
Boris Samorodov (bsam) · 2018.3.1
java/intellij: Update to version 2018.3.1
833b826f3e
Boris Samorodov (bsam) · 2018.3
java/intellij: Update to version 2018.3
a838265959
Boris Samorodov (bsam) · 2018.2.5
java/intellij: Update to version 2018.2.5
d59852a996
Boris Samorodov (bsam) · 2018.2.4
java/intellij: Update to version 2018.2.4
dd1fa1c0e9