CVE-2020-4546
published 2020-09-02CVE-2020-4546: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web…
PriorityP424medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.56%
42.9th percentile
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | doors_next | — | — |
| ibm | engineering_requirements_management_doors_next | — | — |
| ibm | engineering_test_management | — | — |
| ibm | engineering_workflow_management | — | — |
| ibm | engineering_workflow_management | — | — |
| ibm | engineering_workflow_management | — | — |
| ibm | eni | — | — |
| ibm | rational_collaborative_lifecycle_management | — | — |
| ibm | rational_collaborative_lifecycle_management | — | — |
| ibm | rational_collaborative_lifecycle_management | — | — |
| ibm | rational_doors_next_generation | — | — |
| ibm | rational_doors_next_generation | — | — |
| ibm | rational_doors_next_generation | — | — |
| ibm | rational_doors_next_generation | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_rhapsody_design_manager | — | — |
| ibm | rational_rhapsody_design_manager | — | — |
| ibm | rational_rhapsody_design_manager | — | — |
| ibm | rational_rhapsody_design_manager | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_msrc7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w4g9-x3vj-9jv7: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting
ghsa_unreviewed·2022-05-24
CVE-2020-4546 [LOW] GHSA-w4g9-x3vj-9jv7: IBM Jazz Team Server based Applications are vulnerable to cross-site scripting
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183314.
Microsoft
Microsoft Excel Remote Code Execution Vulnerability
vendor_msrc·2020-12-08·CVSS 7.8
CVE-2020-17122 [HIGH] Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Microsoft Office: Microsoft Office
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Reference: https://www.microsoft.com/download/details.aspx?familyid=7a226cd2-e1f8-4306-a097-1d673e342af7
Reference: https://support.microsoft.com/kb/4486698
Reference: https://www.microsoft.com/download/details.aspx?familyid=7efbfde6-8cbe-4f90-85db-eb23ccbdd52d
Reference: https://www.microsoft.com/download/details.aspx?familyid=681663f5-406b-4546-bbba-56341d78
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-02
Published