IBM DevOps Plan Authentication and Privacy

Brute force credential attacks against IBM DevOps Plan 3.0.0 through 3.0.5 allow unauthenticated remote attackers to gain account credentials due to missing or inadequate account lockout protections. The vulnerability enables systematic password guessing without rate limits or lockouts, potentially exposing user accounts. No active exploitation or public proof-of-concept is known, and EPSS indicates a very low likelihood of exploitation (0.05%).

IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system. [CVSS 6.2 MEDIUM]