Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

IBM Engineering Lifecycle Management - Global Configuration ManagementIBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting

Risk 34
Severity
5.4
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global Configuration Management is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: MITRE

Remedy

IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below: IBM recommends customers on ELM 7.0.1, 7.0.2 or any version below 7.0.3 to upgrade your products to Maintenance release 7.0.3 and apply below fix. Optionally, upgrade to the latest 7.2.0 version. Affected Product(s)Version(s)Remediation/Fix/InstructionsIBM Engineering Lifecycle Management - Jazz Foundation 7.0.3Download and install iFix018 https://www.ibm.com/support/fixcentral/swg/downloadFixes  or laterIBM Engineering Lifecycle Management - Jazz Foundation 7.1.0Download and install iFix005 https://www.ibm.com/support/fixcentral/swg/downloadFixes  or later
First published (updated )
CVE-2025-36033

IBM Collaborative Lifecycle ManagementIBM Jazz Foundation information disclosure

Risk 33
Severity
5.5
Infoleak
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that could be used in further attacks against the system. IBM X-Force ID: 230498.

1 / 2
First published (updated )
CVE-2022-34355

IBM Engineering Lifecycle OptimizationXSS

Risk 35
Severity
5.4
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Workflow Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
First published (updated )
CVE-2021-29673

IBM EWMXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2020-5004

IBM EWMSSRF

Risk 47
Severity
6.5
SSRF
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

IBM Jazz Foundation is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

1 / 2
First published (updated )
CVE-2020-4974

IBM PUBXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198235.

1 / 2
First published (updated )
CVE-2021-20507

IBM DOORS NextIBM Jazz Foundation could allow a remote attacker to obtain sensitive information when an error mess…

Risk 39
Severity
6.5
PR:L/AV:N/I:N/UI:N/A:N/AC:L/S:U/C:L/RC:C/E:U/RL:O

IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 195516.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20371

IBM DOORS NextXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-29670

IBM DOORS NextSSRF

Risk 35
Severity
5.5
SSRF
A:N/AC:L/UI:N/I:L/PR:L/AV:N/C:L/S:U/RC:C/E:U/RL:O

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-ForceID: 194597.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20348

IBM DOORS NextSSRF

Risk 35
Severity
5.5
SSRF
PR:L/AV:N/I:L/UI:N/A:N/AC:L/S:U/C:L/E:U/RL:O/RC:C

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194594.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20345

IBM DOORS NextXSS

Risk 41
Severity
6.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4977

IBM DOORS NextSSRF

Risk 35
Severity
5.5
SSRF
C:L/S:U/UI:N/A:N/AC:L/I:L/AV:N/PR:L/RC:C/RL:O/E:U

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194595.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20346

IBM DOORS NextIBM Engineering Test Management could allow an authenticated user to obtain sensitive information du…

Risk 39
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

IBM Engineering Test Management could allow an authenticated user to obtain sensitive information due to lack of security restrictions.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4732

IBM DOORS NextXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Publishing is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-29668

IBM DOORS NextSSRF

Risk 35
Severity
5.5
SSRF
S:U/C:L/PR:L/AV:N/I:L/A:N/AC:L/UI:N/RC:C/E:U/RL:O

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20343

IBM DOORS NextXSS

Risk 35
Severity
5.4
XSS
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Test Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
First published (updated )
CVE-2021-20338

IBM DOORS NextSSRF

Risk 35
Severity
5.5
SSRF
C:L/S:U/AC:L/A:N/UI:N/I:L/AV:N/PR:L/E:U/RL:O/RC:C

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194596.

1 / 2
Source: MITRE
First published (updated )
CVE-2021-20347

IBM DOORS NextXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Test Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2020-5030

IBM Collaborative Lifecycle ManagementXSS

Risk 41
Severity
6.4
XSS
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

IBM Engineering Requirements Management DOORS Next is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4920

IBM Collaborative Lifecycle ManagementIBM Jazz Foundation contains an undisclosed vulnerability that could allow an authenticated user to …

Risk 23
Severity
4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

IBM Jazz Foundation contains an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4964

IBM Collaborative Lifecycle ManagementXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-20519

IBM EWMXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Workflow Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-20506

IBM EWMXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-20447

IBM EWMXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering Lifecycle Optimization - Engineering Insights is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2021-20520

IBM RDNGXSS

Risk 41
Severity
6.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190566.

1 / 2
First published (updated )
CVE-2020-4863

IBM RDNGXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 194707.

1 / 2
First published (updated )
CVE-2021-20350

IBM RDNGXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192435.

1 / 2
First published (updated )
CVE-2020-4975

IBM RDNGXSS

Risk 41
Severity
6.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190459.

1 / 2
First published (updated )
CVE-2020-4856

IBM Collaborative Lifecycle ManagementIBM Jazz Foundation could allow a remote attacker to hijack the clicking action of the victim. By pe…

Risk 35
Severity
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Jazz Foundation could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4547

IBM Collaborative Lifecycle ManagementXSS

Risk 35
Severity
5.4
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

1 / 2
Source: IBM
First published (updated )
CVE-2020-4524

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203