IBM Engineering Lifecycle Optimization Publishing vulnerabilities

12 CVEs affecting IBM Engineering Lifecycle Optimization Publishing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-41768, published 2025-01-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39017, published 2022-07-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID:…
CVE-2021-39019, published 2022-07-14. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force…
CVE-2021-39018, published 2022-07-14. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose sensitive information in a SQL error message that could aid in further attacks against the…
CVE-2023-45188, published 2024-06-09. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially…
CVE-2024-41765, published 2025-01-04. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request…
CVE-2021-39016, published 2022-07-14. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the…
CVE-2024-41766, published 2025-01-04. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.
CVE-2021-39028, published 2022-07-14. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This…
CVE-2021-39015, published 2022-07-14. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2024-41768, published 2025-01-04. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure…

Latest

CVE-2024-41767, published 2025-01-04. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to…
CVE-2024-41763, published 2025-01-04. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.