IBM Engineering Lifecycle Management vulnerabilities

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 and 7.2.0 Interim Fix 001 DOORS are vulnerable to a denial of service attack due to improper handling of XML entity expansion.

Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.

XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.