CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39028
https://notcve.org/view.php?id=CVE-2021-39028
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 213866. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, es vulnerable a una inyección de encabezados HTTP, causada por la incorrecta comprobación de la entrada de los encabezados HOST. Esto podría permitir a un atacante conducir varios ataques contra el sistema vulnerable, incluyendo de tipo cross-site scripting, envenenamiento de caché o secuestro de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/213866 https://www.ibm.com/support/pages/node/6603347 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39019
https://notcve.org/view.php?id=CVE-2021-39019
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, podría divulgar información altamente confidencial mediante una petición HTTP GET a un usuario autenticado. IBM X-Force ID: 213728 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213728 https://www.ibm.com/support/pages/node/6603355 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39018
https://notcve.org/view.php?id=CVE-2021-39018
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the system. IBM X-Force ID: 213726. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, podría divulgar información confidencial en un mensaje de error SQL que podría ayudar a realizar más ataques contra el sistema. IBM X-Force ID: 213726 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213726 https://www.ibm.com/support/pages/node/6603345 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39017
https://notcve.org/view.php?id=CVE-2021-39017
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, podría permitir a un atacante remoto cargar archivos arbitrarios, causado por controles de acceso inapropiados. IBM X-Force ID: 213725 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213725 https://www.ibm.com/support/pages/node/6603341 •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2021-39016
https://notcve.org/view.php?id=CVE-2021-39016
IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722. IBM Engineering Lifecycle Optimization - Publishing versiones 6.0.6, 6.0.6.1, 7.0, 7.0.1 y 7.0.2, no supervisa ni controla suficientemente el volumen de tráfico de red transmitido, por lo que un actor puede causar que el software transmita más tráfico del que debería estar permitido para ese actor. IBM X-Force ID: 213722 • https://exchange.xforce.ibmcloud.com/vulnerabilities/213722 https://www.ibm.com/support/pages/node/6603335 •