Priority LOW 25
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2022-07-14 · No fix listed CWE-74
Priority LOW 30
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00843 · Published 2022-07-14 · No fix listed CWE-200
Priority LOW 21
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00654 · Published 2022-07-14 · No fix listed CWE-209
Priority LOW 31
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00905 · Published 2022-07-14 · No fix listed
Priority LOW 21
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit m…
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0058 · Published 2022-07-14 · No fix listed
Priority LOW 25
IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2022-07-14 · No fix listed CWE-79
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 31
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01195 · Published 2021-06-02 · No fix listed CWE-209
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00504 · Published 2021-06-02 · No fix listed CWE-918
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 25
IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00495 · Published 2021-06-02 · No fix listed CWE-79
Priority LOW 30
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00801 · Published 2021-06-02 · No fix listed
Priority MEDIUM 43
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02648 · Published 2021-06-02 · No fix listed
Priority LOW 24
IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.01172 · Published 2020-07-16 · No fix listed
Priority LOW 25
IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00561 · Published 2020-02-12 · No fix listed CWE-79
Priority LOW 26
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00968 · Published 2019-01-04 · No fix listed CWE-79
Priority LOW 26
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00968 · Published 2019-01-04 · No fix listed CWE-79
Priority LOW 25
IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0066 · Published 2018-10-12 · No fix listed CWE-79
Priority LOW 25
IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0066 · Published 2018-10-12 · No fix listed CWE-79
Load more
THREATIST.IORead the docs