CVE-2021-39059

CVE-2021-39059 affects IBM Jazz Team Server (Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2). The root cause is cross-site scripting due to insufficient input/data validation and output handling in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credent...

CVE-2024-41780

IBM Jazz Foundation versions 7.0.2, 7.0.3, and 7.1.0 are affected by CVE-2024-41780, which can disclose sensitive information because password fields are not masked during entry. The vulnerability arises from plaintext password handling, enabling a physical user to read entered passwords. IBM’s b...

CVE-2023-26280

The CVE-2023-26280 issue affects IBM Jazz Foundation 7.0.2 and 7.0.3, where improper access control could let a user change their dashboard via a specially crafted HTTP request. The root cause is access-control weakness in the dashboard feature, with a CVSSv3.1 base score of 5.3 (Network, Low att...

CVE-2024-5591

The CVE-2024-5591 issue affects IBM Jazz Foundation/Jazz on IBM Engineering Lifecycle Management (ELM) versions 7.0.2, 7.0.3, and 7.1.0. The root cause is information disclosure via detailed browser error messages (CWE-209), allowing a remote attacker to obtain sensitive information and potential...

CVE-2023-45181

CVE-2023-45181 affects IBM Jazz Foundation 7.0.2 and earlier. Red Hat/NRD and other sources corroborate a cross-site scripting vulnerability that allows an attacker to inject arbitrary JavaScript into the Web UI, potentially enabling credentials disclosure within a trusted session. The issue aris...

CVE-2021-29669

CVE-2021-29669 affects IBM Jazz Foundation (versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2). The issue is a cross-site scripting vulnerability that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The public m...

CVE-2019-4457

The CVE-2019-4457 entry relates to IBM Jazz Foundation 6.0.x (including 6.0.6.1) where an authenticated user could obtain sensitive information. Connected IBM security bulletin confirms the issue affects multiple CLM/Rational products built on IBM Jazz technology and labels it as an information d...

CVE-2025-36157

IBM Engineering Lifecycle Management’s Jazz Foundation component is affected by CVE-2025-36157 in versions 7.0.2 (iFix035), 7.0.3 (iFix018), and 7.1.0 (iFix004). The issue arises from the ability of an unauthenticated remote attacker to update server property files, enabling unauthorized actions ...

CVE-2024-43184

IBM Jazz Foundation (part of IBM Engineering Lifecycle Management) is affected by CVE-2024-43184. Affected versions are 7.0.2 with iFix033, 7.0.3 with iFix012, and 7.1.0 with iFix002. The vulnerability is a cross-site scripting flaw that allows an unauthenticated attacker to embed arbitrary JavaS...

CVE-2025-15395

CVE-2025-15395 affects IBM Engineering Lifecycle Management - Jazz Foundation. The vulnerability is an access control violation in Jazz Foundation components: IBM Jazz Foundation 7.0.3 with iFix019 and 7.1.0 with iFix005. Root cause details are not expanded beyond the access-control bypass in the...

CVE-2025-1826

CVE-2025-1826 affects IBM Engineering Requirements Management DOORS Next / Jazz Foundation (versions 7.0.2 to 7.1.0 with specific iFixes). It is a stored cross-site scripting vulnerability that allows an authenticated user on the host network to embed arbitrary JavaScript in the Web UI, potential...

CVE-2025-25048

CVE-2025-25048 affects IBM Engineering Lifecycle Management - Jazz Foundation (versions 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002). The issue is a Relative Path Traversal caused by improper neutralization of sequences that can resolve to a restricte...