Ibm Engineering Lifecycle Optimization Publishing vulnerabilities

CVE-2023-45188 [CRITICAL] CWE-434 CVE-2023-45188: IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to up IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary co

CVE-2020-4495 [HIGH] CVE-2020-4495: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security re IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114

CVE-2024-41767 [HIGH] CWE-89 CVE-2024-41767: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2023-45187 [HIGH] CWE-613 CVE-2023-45187: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session afte IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.

CVE-2023-45191 [HIGH] CWE-307 CVE-2023-45191: IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting th IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 268755.

CVE-2024-41765 [MEDIUM] CWE-22 CVE-2024-41765: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2024-41763 [HIGH] CWE-327 CVE-2024-41763: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected crypt IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVE-2021-39017 [MEDIUM] CVE-2021-39017: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allo IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725.

CVE-2024-41766 [HIGH] CWE-1333 CVE-2024-41766: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker t IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.

CVE-2021-39019 [MEDIUM] CWE-200 CVE-2021-39019: IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disc IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728.

CVE-2024-41768 [MEDIUM] CWE-544 CVE-2024-41768: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure state.

CVE-2016-2914 [MEDIUM] CWE-434 CVE-2016-2914: Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (ak Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.

CVE-2021-20371 [MEDIUM] CWE-209 CVE-2021-20371: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive i IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.

CVE-2020-4732 [MEDIUM] CVE-2020-4732: IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensiti IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.

CVE-2021-20347 [MEDIUM] CWE-918 CVE-2021-20347: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194596.

CVE-2021-20346 [MEDIUM] CWE-918 CVE-2021-20346: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595.

CVE-2021-20343 [MEDIUM] CWE-918 CVE-2021-20343: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.

CVE-2021-20345 [MEDIUM] CWE-918 CVE-2021-20345: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.

CVE-2021-20348 [MEDIUM] CWE-918 CVE-2021-20348: IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.

CVE-2017-1787 [MEDIUM] CWE-798 CVE-2017-1787: IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. IBM X-Force ID: 137022.