Priority MEDIUM 42
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00339 · Published 2024-12-25 · No fix listed CWE-1022
Priority LOW 30
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00383 · Published 2024-12-25 · No fix listed CWE-209
Priority MEDIUM 43
IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00704 · Published 2024-11-15 · No fix listed CWE-611
Priority LOW 25
IBM Jazz Foundation products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-07-28 · No fix listed CWE-79
Priority LOW 29
IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF).
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00598 · Published 2021-07-28 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 31
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01195 · Published 2021-06-02 · No fix listed CWE-209
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 30
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00801 · Published 2021-06-02 · No fix listed
Priority MEDIUM 43
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02648 · Published 2021-06-02 · No fix listed
THREATIST.IORead the docs