IBM Engineering Requirements Management Doors vulnerabilities

13 CVEs affecting IBM Engineering Requirements Management Doors, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-43190, published 2025-07-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1457, published 2018-06-27. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force ID: 140208.
CVE-2017-1515, published 2018-01-26. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses. IBM X-Force ID: 129825.
CVE-2017-1516, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this…
CVE-2017-1567, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1563, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1540, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2017-1532, published 2018-01-26. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. IBM DOORS 9.5 and 9.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially…
CVE-2023-50304, published 2024-07-18. High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
CVE-2017-1545, published 2018-01-26. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Doors Web Access 9.5 and 9.6 could allow an attacker with physical access to the system to log into the application using previously stored credentials. IBM X-Force ID: 130914.
CVE-2024-43190, published 2025-07-07. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a legitimate user using man in the middle…

Latest

CVE-2023-50305, published 2024-03-01. Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM…
CVE-2023-28949, published 2024-03-01. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user…
CVE-2023-28525, published 2024-03-01. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…