IBM Doors Next vulnerabilities

27 CVEs affecting IBM Doors Next, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-27253, published 2026-08-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-41787, published 2025-01-10. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request,…
CVE-2020-4544, published 2021-01-08. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4487, published 2021-01-08. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4857, published 2021-03-04. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Engineering products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4965, published 2021-04-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.
CVE-2023-45192, published 2024-06-06. High severity, CVSS 8.2. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
CVE-2020-4964, published 2021-04-12. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users.…
CVE-2021-20519, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4920, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2021-20351, published 2021-03-04. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…

Latest

CVE-2024-27253, published 2026-08-12. Critical severity, CVSS 10.0. EPSS: 0.6% chance of exploitation in the next 30 days. IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.
CVE-2021-20350, published 2021-03-04. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2021-20340, published 2021-03-04. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…