CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39018
https://notcve.org/view.php?id=CVE-2021-39018
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, podría divulgar información confidencial en un mensaje de error SQL que podría ayudar a realizar más ataques contra el sistema. IBM X-Force ID: 213726 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213726 https://www.ibm.com/support/pages/node/6603345 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39017
https://notcve.org/view.php?id=CVE-2021-39017
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, podría permitir a un atacante remoto cargar archivos arbitrarios, causado por controles de acceso inapropiados. IBM X-Force ID: 213725 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213725 https://www.ibm.com/support/pages/node/6603341 •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39016
https://notcve.org/view.php?id=CVE-2021-39016
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, no supervisa ni controla suficientemente el volumen de tráfico de red transmitido, por lo que un actor puede causar que el software transmita más tráfico del que debería estar permitido para ese actor. IBM X-Force ID: 213722 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213722 https://www.ibm.com/support/pages/node/6603335 •
CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39015
https://notcve.org/view.php?id=CVE-2021-39015
IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 213655. IBM Engineering Lifecycle Optimization - Publishing versiones 7.0, 7.0.1 y 7.0.2, es vulnerable a un ataque de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista y conllevando potencialmente a una divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/213655 https://www.ibm.com/support/pages/node/6603333 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 19EXPL: 0CVE-2021-29844
https://notcve.org/view.php?id=CVE-2021-29844
IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Los productos IBM Jazz Team Server son vulnerables a un ataque de tipo server-side request forgery (SSRF). Esto puede permitir a un atacante autenticado enviar peticiones no autorizadas desde el sistema, conllevando potencialmente a una enumeración de la red o facilitar otros ataques • https://exchange.xforce.ibmcloud.com/vulnerabilities/205205 https://www.ibm.com/support/pages/node/6508583 • CWE-918: Server-Side Request Forgery (SSRF) •