In JetBrains TeamCity before 2023.05.1 reflected XSS via the Referer header was possible during artifact downloads