In JetBrains TeamCity prior to 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads
jetbrains teamcity