IBM Jazz For Service Management
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in IBM Jazz For Service Management.
By the Year
In 2026 there have been 0 vulnerabilities in IBM Jazz For Service Management. Last year, in 2025 Jazz For Service Management had 3 security vulnerabilities published. Right now, Jazz For Service Management is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 3 | 5.77 |
| 2024 | 1 | 7.50 |
| 2023 | 0 | 0.00 |
| 2022 | 2 | 5.40 |
| 2021 | 2 | 6.75 |
| 2020 | 1 | 5.40 |
| 2019 | 5 | 5.90 |
It may take a day or so for new Jazz For Service Management vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Jazz For Service Management Security Vulnerabilities
IBM Jazz SM 1.1.3.0-25: Auth Token Cookie Lacks Secure Flag
CVE-2025-36249
3.7 - Low
- October 31, 2025
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
XSS in IBM Jazz Service Mgmt 1.1.3-1.1.3.23 Web UI
CVE-2024-52892
6.1 - Medium
- February 06, 2025
IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
XSS
Remote Info Disclosure in IBM Jazz Service Management 1.1.3-1.1.3.22
CVE-2024-47106
7.5 - High
- January 18, 2025
IBM Jazz for Service Management 1.1.3 through 1.1.3.22 could allow a remote attacker to obtain sensitive information from improper access restrictions that could aid in further attacks against the system.
Files or Directories Accessible to External Parties
Forced Browsing in IBM Jazz SM 1.1.3.20 allows Unauthorized File Info
CVE-2023-46186
7.5 - High
- February 14, 2024
IBM Jazz for Service Management 1.1.3.20 could allow an unauthorized user to obtain sensitive file information using forced browsing due to improper access controls. IBM X-Force ID: 269929.
forced browsing
IBM Jazz for Service Management: Stored XSS in Web UI
CVE-2022-35722
5.4 - Medium
- September 28, 2022
IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.
XSS
Stored XSS in IBM Jazz Service Mgmt 1.1.3
CVE-2022-35721
5.4 - Medium
- September 23, 2022
IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.
XSS
IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting
CVE-2021-29800
5.4 - Medium
- September 23, 2021
IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
XSS
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data
CVE-2021-29831
8.1 - High
- September 21, 2021
IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 204775.
XXE
IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting
CVE-2019-4718
5.4 - Medium
- March 23, 2020
IBM Jazz for Service Management 3.13 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172123.
XSS
IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection
CVE-2019-4186
6.1 - Medium
- September 05, 2019
IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-force ID: 158976.
XSS
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names
CVE-2019-4275
5.5 - Medium
- August 02, 2019
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could cause a denial of service. IBM X-Force ID: 160296.
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control
CVE-2019-4194
4.3 - Medium
- July 17, 2019
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 is missing function level access control that could allow a user to delete authorized resources. IBM X-Force ID: 159033.
IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters
CVE-2019-4193
7.5 - High
- July 11, 2019
IBM Jazz for Service Management 1.1.3 and 1.1.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-force ID: 159032.
Information Disclosure
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could
CVE-2019-4201
6.1 - Medium
- June 06, 2019
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 159122.
Open Redirect
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for IBM Jazz For Service Management or by IBM? Click the Watch button to subscribe.
