IBM Engineering Lifecycle Optimization Publishing vulnerabilities, page 2
31 vulnerabilities
Known vulnerabilities in IBM Engineering Lifecycle Optimization Publishing, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2016-2912ibmengineering_lifecycle_optimization_-_publishing
EPSS score0.61%
Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.CVE-2020-4977ibmcollaborative_lifecycle_management+11EPSS score0.50%
IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 192470.CVE-2020-4495ibmcollaborative_lifecycle_management+11EPSS score2.65%
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially-crafted request to the REST API, an attacker could exploit this vulnerability to bypass access restrictions, and execute arbitrary actions with administrative privileges. IBM X-Force ID: 182114.CVE-2020-4316ibmengineering_lifecycle_optimization_-_publishing+1EPSS score1.17%
IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 177354.CVE-2020-4732ibmcollaborative_lifecycle_management+11EPSS score0.80%
IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security restrictions. IBM X-Force ID: 188126.CVE-2020-5030ibmcollaborative_lifecycle_management+11EPSS score0.50%
IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 193737.CVE-2017-1787ibmengineering_lifecycle_optimization_-_publishing+1EPSS score0.35%
IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. IBM X-Force ID: 137022.CVE-2019-4431ibmengineering_lifecycle_optimization_-_publishing+1EPSS score0.56%
IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162888.CVE-2023-45191ibmengineering_lifecycle_optimization+1EPSS score0.66%
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 268755.CVE-2023-45190ibmengineering_lifecycle_optimization+1EPSS score0.26%
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 268754.CVE-2023-45187ibmengineering_lifecycle_optimization+1EPSS score0.38%
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 268749.