Security Bulletin: Multiple Vulnerabilities in IBM DevOps Build.

Summary Multiple vulnerabilities were addressed in IBM DevOps Build 7.1.0.2. Vulnerability Details CVEID:CVE-2025-52434 DESCRIPTION: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This w...

CVE-2025-36364: Use of Web Browser Cache Containing Sensitive Information

IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system...

IBM DevOps Plan 安全漏洞

IBM DevOps Plan is a change management collaboration platform provided by the American multinational company International Business Machines IBM. Versions of IBM DevOps Plan 3.0.0 and earlier contained security vulnerabilities. These vulnerabilities were due to improper account locking settings,...

PT-2026-22798

Name of the Vulnerable Software and Affected Versions IBM DevOps Plan versions 3.0.0 through 3.0.5 Description The software uses an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations Update to a version beyond 3.0.5...

CVE-2025-36363: Improper Restriction of Excessive Authentication Attempts

IBM DevOps Plan 3.0.0 through 3.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

IBM DevOps Plan 安全漏洞

IBM DevOps Plan is a change management collaboration platform provided by the American multinational company International Business Machines IBM. Versions of IBM DevOps Plan 3.0.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the ability for web cache data to ...

PT-2026-22799

Name of the Vulnerable Software and Affected Versions IBM DevOps Plan versions 3.0.0 through 3.0.5 Description The software allows web page cache to be stored locally. This cached information can be accessed by another user on the same system. Recommendations Update to a version newer than 3.0.5...

devops-security-pipeline-poc

DevOps Security Pipeline POC A security-integrated CI/CD pipe...

Security Bulletin: IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters. (CVE-2025-36364)

Summary A vulnerability has been identified in IBM DevOps Plan REST APIs where sensitive data is transmitted via request query parameters. Vulnerability Details CVEID:CVE-2025-36364 DESCRIPTION: IBM DevOps Plan allows web page cache to be stored locally which can be read by another user on the...

Security Bulletin: A security vulnerability have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase [CVE-2025-13333]

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Updates for Azure DevOps 2022 XSS (February 2026)

The Microsoft Team Foundation Server is missing a security update. It is, therefore, affected by the following vulnerability: - A session spoofing vulnerability exists. An attacker can exploit this to perform actions with the privileges of another user. CVE-2026-21512 Note that Nessus has not...

The vulnerability of the Azure DevOps Server software lies in the insufficient testing of server-side requests, which allows attackers to perform spearfishing attacks.

The vulnerability of the Azure DevOps Server software lies in insufficient testing of server-side requests. Exploiting this vulnerability allows attackers to perform spear-phishing attacks remotely...

CVE-2026-21512

Server-side request forgery ssrf in Azure DevOps Server allows an authorized attacker to perform spoofing over a network...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM DevOps Code ClearCase [CVE-2025-53066 ,CVE-2025-53057]

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM DevOps Code ClearCase. Information about security vulnerabilities affecting WAS have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2026-21512

Server-side request forgery ssrf in Azure DevOps Server allows an authorized attacker to perform spoofing over a network...

CVE-2026-21512

Server-side request forgery ssrf in Azure DevOps Server allows an authorized attacker to perform spoofing over a network...

CVE-2026-21512

Server-side request forgery ssrf in Azure DevOps Server allows an authorized attacker to perform spoofing over a network...

CVE-2026-21512 Azure DevOps Server Cross-Site Scripting Vulnerability

...

CVE-2026-21512 Azure DevOps Server Cross-Site Scripting Vulnerability

...

CVE-2026-21512

CVE-2026-21512 describes a server-side request forgery vulnerability in Azure DevOps Server . The connected documents consistently state an SSRF issue that enables an authorized attacker to perform spoofing over a network , effectively allowing impersonation of another user within affected compon...