IBM Rhapsody Model Manager vulnerabilities

23 CVEs affecting IBM Rhapsody Model Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-20519, published 2021-04-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4544, published 2021-01-08. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2020-4487, published 2021-01-08. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in…
CVE-2018-1734, published 2019-06-27. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 discloses sensitive information in error messages that may be used by a malicious user to orchestrate further attacks. IBM X-Force…
CVE-2020-4547, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this…
CVE-2020-4965, published 2021-04-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422.
CVE-2021-20357, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4865, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4855, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4524, published 2021-01-27. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2018-1690, published 2018-08-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…

Latest

CVE-2021-20519, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4964, published 2021-04-12. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users.…
CVE-2020-4920, published 2021-04-12. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2020-4733, published 2021-01-08. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…