Vulnerabilities > IBM > Engineering Lifecycle Optimization Publishing > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-07-16 | CVE-2020-4316 | Unspecified vulnerability in IBM Engineering Lifecycle Optimization - Publishing 6.0.6/6.0.6.1/7.0 IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. | 4.7 |
| 2020-02-12 | CVE-2019-4431 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 6.0.6/6.0.6.1 IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. | 5.4 |
| 2019-01-04 | CVE-2018-1951 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 2.1.2/6.0.5/6.0.6 IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. | 5.4 |
| 2019-01-04 | CVE-2018-1657 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 2.1.2/6.0.5/6.0.6 IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. | 5.4 |
| 2018-10-12 | CVE-2018-1534 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 6.0.5/6.0.6 IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting. | 5.4 |
| 2018-10-12 | CVE-2018-1533 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 6.0.5/6.0.6 IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting. | 5.4 |
| 2018-03-02 | CVE-2017-1787 | Use of Hard-coded Credentials vulnerability in IBM Engineering Lifecycle Optimization - Publishing 2.1.2/6.0.5 IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded user credentials. | 6.7 |
| 2016-08-08 | CVE-2016-2914 | Unrestricted Upload of File with Dangerous Type vulnerability in IBM Engineering Lifecycle Optimization - Publishing 2.0.1 Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension. | 5.4 |
| 2016-08-08 | CVE-2016-2912 | Cross-site Scripting vulnerability in IBM Engineering Lifecycle Optimization - Publishing 2.0.1 Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. | 5.4 |