In JetBrains TeamCity prior to 2021.2, blind SSRF via an XML-RPC call was possible.
jetbrains teamcity