Ibm Engineering Lifecycle Optimization - Publishing vulnerabilities

CVE-2023-45187 [MEDIUM] CWE-613 CVE-2023-45187: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session afte IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.

CVE-2023-45191 [HIGH] CWE-307 CVE-2023-45191: IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting th IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 268755.

CVE-2023-45190 [MEDIUM] CWE-307 CVE-2023-45190: IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, cause IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 268754.

CVE-2021-39015 [MEDIUM] CWE-79 CVE-2021-39015: IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-sit IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655.

CVE-2021-39018 [MEDIUM] CWE-209 CVE-2021-39018: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disc IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726.

CVE-2021-39016 [MEDIUM] CVE-2021-39016: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not s IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722.

CVE-2021-39017 [MEDIUM] CVE-2021-39017: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allo IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725.

CVE-2021-39028 [MEDIUM] CWE-74 CVE-2021-39028: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnera IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X

CVE-2021-39019 [MEDIUM] CWE-200 CVE-2021-39019: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disc IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728.

CVE-2020-4495 [HIGH] CVE-2020-4495: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security re IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114

CVE-2021-20347 [MEDIUM] CWE-918 CVE-2021-20347: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194596.

CVE-2021-29668 [MEDIUM] CWE-79 CVE-2021-29668: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulner IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199406.

CVE-2021-20346 [MEDIUM] CWE-918 CVE-2021-20346: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595.

CVE-2020-5030 [MEDIUM] CWE-79 CVE-2020-5030: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulner IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 193737.

CVE-2020-4732 [MEDIUM] CVE-2020-4732: IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensiti IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.

CVE-2021-20371 [MEDIUM] CWE-209 CVE-2021-20371: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive i IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.

CVE-2021-20338 [MEDIUM] CWE-79 CVE-2021-20338: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulner IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194449.

CVE-2021-20343 [MEDIUM] CWE-918 CVE-2021-20343: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.

CVE-2021-20345 [MEDIUM] CWE-918 CVE-2021-20345: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.

CVE-2021-29670 [MEDIUM] CWE-79 CVE-2021-29670: IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulner IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199408.