CVE-2021-29865

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 206091.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
IBM	Jazz Team Server	6.0.6; 6.0.6.1; 7.0; 7.0.1; 7.0.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/206091VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6597505Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/206091VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/6597505Patch, Vendor Advisory

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-298675.4IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. CVE-2021-298685.5IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. IBM X-For CVE-2021-298725.4IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by impr CVE-2021-298738.1IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted CVE-2021-298757.5IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access v CVE-2021-298785.4IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2021-298806.5IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenant CVE-2021-298834.3IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization token CVE-2021-298888.8IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un CVE-2021-298914.9IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network CVE-2021-298925.9IBM Cognos Controller 11.0.0 and 11.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly ena CVE-2021-298947.5IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow