IBM Jazz For Service Management vulnerabilities

28 CVEs affecting IBM Jazz For Service Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36249, published 2025-10-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4193, published 2019-07-11. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server…
CVE-2019-4186, published 2019-09-05. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a…
CVE-2021-29831, published 2021-09-21. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2019-4194, published 2019-07-17. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
CVE-2019-4201, published 2019-06-06. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a…
CVE-2022-35721, published 2022-09-23. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2019-4718, published 2020-03-23. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2023-46186, published 2024-02-14. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access controls. IBM X-Force ID: 269929.
CVE-2017-1746, published 2017-12-20. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from…
CVE-2017-1631, published 2017-12-20. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from…

Latest

CVE-2025-36249, published 2025-10-31. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a…
CVE-2025-36011, published 2025-09-09. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a…
CVE-2024-52892, published 2025-02-06. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI…
CVE-2024-47106, published 2025-01-18. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that could aid in further attacks against the…
CVE-2022-35722, published 2022-09-28. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2021-38877, published 2021-09-23. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2021-29905, published 2021-09-23. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2021-29904, published 2021-09-23. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 207610.