CVE-2021-20355

The CVE-2021-20355 affects IBM Jazz Team Server versions 6.0.6–7.0.2, where the HTTPOnly flag is not set on cookies, enabling a remote attacker to obtain sensitive data from cookies. The issue is documented across multiple sources (IBM bulletin and CVE records). Remediation is available via IBM i...

CVE-2021-38871

CVE-2021-38871 affects IBM Jazz Team Server (versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2). Root cause: cross-site scripting due to unsafe handling of data in HTTP requests that is reflected in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials withi...

CVE-2021-39043

IBM Jazz Team Server (Jazz Team Server) versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 are affected by CVE-2021-39043 allowing stored cross-site scripting in the Web UI, potentially leading to credentials disclosure within a trusted session. The root cause is a stored XSS flaw in the Web UI that ...

CVE-2021-20544

CVE-2021-20544 affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The issue is a server-side request forgery (SSRF) vulnerability that could allow an authenticated attacker to cause the server to issue unauthorized requests from the system, enabling network enumeration o...

CVE-2021-20543

CVE-2021-20543 affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The issue is described as an HTML injection vulnerability that can allow a remote attacker to inject HTML code which, when viewed, is executed in the browser within the hosting site's security context. IBM...

CVE-2021-20551

CVE-2021-20551 affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2, where web pages can be stored locally and read by another user on the same system, causing information disclosure. The issue originates from local storage of sensitive content via browsers/cache as describ...

CVE-2021-20421

CVE-2021-20421 relates to IBM Jazz Team Server SSRF affecting versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The vulnerability allows an authenticated attacker to cause the server to make unauthorized requests from the system, enabling network enumeration or potentially enabling other attacks. T...

CVE-2021-38879

IBM Jazz Team Server versions 6.0.6–7.0.2 are affected by an information disclosure vulnerability due to cookie HTTPOnly flag not being set. The underlying cause is the failure to mark the JSA_CSRF cookie as HttpOnly, allowing a remote attacker to obtain sensitive information from the cookie. Imp...

CVE-2021-29865

The CVE-2021-29865 issue affects IBM Jazz Team Server versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2, where lack of proper HTTP headers (X-Frame-Options / Content-Security-Policy) enables clickjacking, allowing a remote attacker to hijack a user’s click actions by convincing the victim to visit a...