Engineering Workflow Management Vulnerabilities (25 CVEs)

CVE-2024-51454 MEDIUM PATCH This Month

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

IBM XSS Engineering Workflow Management

NVD VulDB

CVSS 3.1

6.1

EPSS

0.2%

CVE-2025-33128 MEDIUM PATCH This Month

Stored cross-site scripting in IBM Engineering Workflow Management's Web UI enables an authenticated low-privileged attacker to inject arbitrary JavaScript that executes in the browser sessions of other users, including administrators, within the same trusted application context. Affected versions span 7.0.3 through 7.0.3 Interim Fix 020 and 7.1 through 7.1 Interim Fix 007. The scope-changed CVSS vector (S:C) confirms that impact crosses the attacker's own session boundary, creating a realistic path to credential theft or session hijacking against higher-privileged users. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.

IBM XSS Engineering Workflow Management

NVD

CVSS 3.1

5.4

EPSS

0.1%

CVE-2024-28793 MEDIUM This Month

IBM Engineering Workflow Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

IBM XSS Engineering Workflow Management

NVD

CVSS 3.1

5.4

EPSS

0.3%

CVE-2021-29844 HIGH PATCH This Week

IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

IBM SSRF Engineering Lifecycle Optimization Engineering Requirements Quality Assistant On Premises Engineering Workflow Management +4

NVD

CVSS 3.1

8.8

EPSS

0.6%

CVE-2021-29786 MEDIUM PATCH This Month

IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

IBM Information Disclosure Engineering Lifecycle Optimization Engineering Workflow Management Rational Collaborative Lifecycle Management +3

NVD

CVSS 3.1

6.5

EPSS

0.5%

CVE-2021-29774 HIGH PATCH This Week

IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.

IBM Information Disclosure Engineering Lifecycle Optimization Engineering Workflow Management Rational Collaborative Lifecycle Management +3

NVD

CVSS 3.1

7.5

EPSS

0.9%

CVE-2021-29673 MEDIUM PATCH This Month

IBM Jazz Team Server products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Lifecycle Optimization Engineering Workflow Management Rational Collaborative Lifecycle Management +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20507 MEDIUM This Month

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

IBM XSS Engineering Lifecycle Optimization Engineering Requirements Quality Assistant On Premises Engineering Workflow Management +4

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20519 MEDIUM PATCH This Month

IBM Jazz Team Server products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Collaborative Lifecycle Management Doors Next Engineering Insights +9

NVD

CVSS 3.1

5.4

EPSS

0.6%

CVE-2021-20520 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20518 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20506 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20504 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20503 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20502 HIGH PATCH This Week

IBM Jazz Foundation Products are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

IBM XXE Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

7.1

EPSS

1.4%

CVE-2021-20447 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20352 MEDIUM PATCH This Month

IBM Jazz Foundation Products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Engineering Insights Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +3

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20351 MEDIUM PATCH This Month

IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Doors Next Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +6

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20350 MEDIUM PATCH This Month

IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Doors Next Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +6

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20340 MEDIUM PATCH This Month

IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Doors Next Engineering Lifecycle Management Engineering Requirements Quality Assistant On Premises +6

NVD

CVSS 3.1

5.4

EPSS

0.5%

CVE-2021-20357 MEDIUM PATCH This Month

IBM Jazz Foundation products is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

IBM XSS Collaborative Lifecycle Management Engineering Insights Engineering Lifecycle Management +8

NVD

CVSS 3.1

5.4

EPSS

0.7%

CVE-2020-4546 MEDIUM This Month

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

XSS IBM Doors Next Engineering Requirements Management Doors Next Engineering Test Management +7

NVD

CVSS 3.1

5.4

EPSS

0.6%

CVE-2020-4522 MEDIUM This Month

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

XSS IBM Doors Next Engineering Requirements Management Doors Next Engineering Test Management +7

NVD

CVSS 3.1

5.4

EPSS

0.6%

CVE-2020-4445 MEDIUM This Month

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

XSS IBM Doors Next Engineering Requirements Management Doors Next Engineering Test Management +7

NVD

CVSS 3.1

5.4

EPSS

0.6%

CVE-2020-4525 MEDIUM PATCH This Month

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

XSS IBM Engineering Workflow Management Rational Rhapsody Design Manager

NVD

CVSS 3.1

5.4

EPSS

0.6%

Engineering Workflow Management

Monthly