Ibm Rational Engineering Lifecycle Manager vulnerabilities

141 known vulnerabilities affecting ibm/rational_engineering_lifecycle_manager.

Total CVEs

141

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

HIGH12MEDIUM124LOW5

Vulnerabilities

SortPage 1 of 8

CVE-2020-4495P2HIGHCVSS 8.8v6.0.6v6.0.6.1+3 more2021-06-02

CVE-2020-4495 [HIGH] CVE-2020-4495: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security re IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114

nvd

CVE-2021-29844P3HIGHCVSS 8.8v7.0v7.0.1+1 more2021-10-27

CVE-2021-29844 [HIGH] CWE-918 CVE-2021-29844: IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

nvd

CVE-2019-4252P3HIGHCVSS 7.5≥ 6.0, ≤ 6.0.6.12019-06-27

CVE-2019-4252 [HIGH] CWE-22 CVE-2019-4252: IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 159883.

nvd

CVE-2016-9707P3HIGHCVSS 8.1v4.0v4.0.1+13 more2017-03-31

CVE-2016-9707 [HIGH] CWE-611 CVE-2016-9707: IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection IBM Jazz Foundation is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000784.

nvd

CVE-2016-6024P4MEDIUMCVSS 4.3PoCv4.0.3v4.0.4+11 more2017-11-27

CVE-2016-6024 [MEDIUM] CWE-200 CVE-2016-6024: IBM Jazz technology based products might divulge information that might be useful in helping attacke IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages. IBM X-Force ID: 116868.

nvd

CVE-2018-1846P3HIGHCVSS 7.1≥ 5.0, ≤ 5.0.2≥ 6.0, ≤ 6.0.6+10 more2018-11-02

CVE-2018-1846 [HIGH] CWE-611 CVE-2018-1846: IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150945.

nvd

CVE-2018-1588P3HIGHCVSS 7.1≥ 5.0, ≤ 5.0.2≥ 6.0, ≤ 6.0.6+10 more2018-09-25

CVE-2018-1588 [HIGH] CWE-611 CVE-2018-1588: IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0 IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6) is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 143501.

nvd

CVE-2018-1607P3HIGHCVSS 7.1≥ 5.0, ≤ 5.0.2≥ 6.0, ≤ 6.0.6+10 more2018-09-25

CVE-2018-1607 [HIGH] CWE-611 CVE-2018-1607: IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 143797.

nvd

CVE-2021-29774P3HIGHCVSS 7.5v6.0.6v6.0.6.1+3 more2021-10-27

CVE-2021-29774 [HIGH] CVE-2021-29774: IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. IBM X-Force ID: 203025.

nvd

CVE-2021-20502P3HIGHCVSS 7.1v6.0.2v6.0.6+1 more2021-03-30

CVE-2021-20502 [HIGH] CWE-611 CVE-2021-20502: IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when pr IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 198059.

nvd

CVE-2018-1608P3HIGHCVSS 7.5≥ 6.0, ≤ 6.0.6v6.0+6 more2019-05-01

CVE-2018-1608 [HIGH] CWE-326 CVE-2018-1608: IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 143798.

nvd

CVE-2020-4965P3HIGHCVSS 7.5v6.0.2v6.0.6+3 more2021-04-12

CVE-2020-4965 [HIGH] CWE-327 CVE-2020-4965: IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.

nvd

CVE-2015-7440P3HIGHCVSS 7.8≥ 4.0.3, ≤ 4.0.7v5.0+4 more2018-03-15

CVE-2015-7440 [HIGH] CWE-264 CVE-2015-7440: IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0. IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1 before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Quality Manager (RQM) 3.0.x before 3.0.1.6 iFix7 Interim Fix 1, 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, and 6.0.x before 6.0.1 iFix4; Rational Team Conc

nvd

CVE-2020-4974P3MEDIUMCVSS 6.3v6.0.2v6.0.6+1 more2021-07-28

CVE-2020-4974 [MEDIUM] CWE-918 CVE-2020-4974: IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 192434.

nvd

CVE-2021-29786P4MEDIUMCVSS 6.5v7.0v7.0.1+1 more2021-10-27

CVE-2021-29786 [MEDIUM] CWE-312 CVE-2021-29786: IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenti IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172.

nvd

CVE-2018-1539P4MEDIUMCVSS 6.5≥ 5.0.0, ≤ 5.0.2≥ 6.0.0, ≤ 6.0.6+10 more2018-09-25

CVE-2018-1539 [MEDIUM] CWE-287 CVE-2018-1539: IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.

nvd

CVE-2018-1423P4MEDIUMCVSS 6.5≥ 5.0, ≤ 5.0.2≥ 6.0.0, ≤ 6.0.5+9 more2018-07-10

CVE-2018-1423 [MEDIUM] CWE-200 CVE-2018-1423: IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks against the system. IBM X-Force ID: 139026.

nvd

CVE-2018-1694P4MEDIUMCVSS 5.9≥ 5.0.0, ≤ 5.0.2≥ 6.0.0, ≤ 6.0.6+10 more2018-11-06

CVE-2018-1694 [MEDIUM] CVE-2018-1694: IBM Jazz applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 thro IBM Jazz applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS Next Generation 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Quality Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Rhapsody D

nvd

CVE-2021-20371P4MEDIUMCVSS 6.5v6.0.6v6.0.6.1+3 more2021-06-02

CVE-2021-20371 [MEDIUM] CWE-209 CVE-2021-20371: IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive i IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.

nvd

CVE-2020-4732P4MEDIUMCVSS 6.5v6.0.6v6.0.6.1+3 more2021-06-02

CVE-2020-4732 [MEDIUM] CVE-2020-4732: IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensiti IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.

nvd

1 / 8Next →