IBM Engineering Requirements Management Doors Next vulnerabilities

21 CVEs affecting IBM Engineering Requirements Management Doors Next, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13734, published 2026-03-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4547, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this…
CVE-2020-4965, published 2021-04-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.
CVE-2021-20357, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4865, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4855, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4524, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4964, published 2021-04-12. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users.…
CVE-2021-20519, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4920, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4546, published 2020-09-02. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…

Latest

CVE-2025-13734, published 2026-03-03. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissions.
CVE-2025-33096, published 2025-10-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user to cause a denial of service by uploading specially crafted files using uncontrolled…
CVE-2025-2140, published 2025-10-12. Medium severity, CVSS 5.7. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to spoof email identity of the sender due to improper verification of source…
CVE-2025-2139, published 2025-10-12. Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of…
CVE-2025-2138, published 2025-10-12. Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete comments from other users due to client-side enforcement of…
CVE-2024-43169, published 2025-03-03. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code.
CVE-2024-41771, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information.
CVE-2024-41770, published 2025-03-03. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information.