7.5

CVE-2026-14979

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update -
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix001
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix002
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix003
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix004
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix005
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix006
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix007
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix008
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix009
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix010
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix011
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix012
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix013
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix014
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix015
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix016
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix017
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix018
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix018_security_fix
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix019
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix020
Ibm ≫ Engineering Lifecycle Management Version 7.0.3 Update ifix021
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update -
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix001
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix0010
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix002
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix003
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix004
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix004_security_fix
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix005
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix006
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix007
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix008
Ibm ≫ Engineering Lifecycle Management Version 7.1.0 Update ifix009
Ibm ≫ Engineering Lifecycle Management Version 7.2.0 Update -
Ibm ≫ Engineering Lifecycle Management Version 7.2.0 Update ifix001
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.316
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
IBM 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

https://www.ibm.com/support/pages/node/7279963
Vendor Advisory