CVE-2015-7468

CVE-2015-7468 concerns IBM Jazz Reporting Service (JRS) as part of Rational Insight. The vulnerability allows remote authenticated users to bypass restrictions on administrator tasks due to improper access control, affecting JRS 5.x up to 5.0.2-Rational-CLM-ifix011 and 6.0 up to 6.0.0-Rational-CL...

CVE-2015-7469

CVE-2015-7469 affects IBM Jazz Reporting Service (JRS) Report Builder. The vulnerability arises from improper access control: users with JazzGuest roles can manipulate data that should be read-only. Affected versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0. IBM’s bulletin recomme...

CVE-2015-7469

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role...

CVE-2015-4962

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team...

Design/Logic Flaw

Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x...

CVE-2015-4962

CVE-2015-4962 affects IBM Jazz-based CLM ecosystem (including CLM, RTC, RQM, RRC, RDNG, RELM, Rhapsody DM, RSA DM, etc.). The root cause is weak permissions on unspecified project areas, allowing remote authenticated users to obtain sensitive information via unknown vectors. Impact is information...

CVE-2015-4946

CVE-2015-4946 affects IBM CLM/Jazz-based products (RCLM, RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM) and related Jazz Team Server components. The issue allows an authenticated user to bypass access restrictions and perform unauthorized actions due to a design/logic flaw in IBM Rational LifeCy...

CVE-2015-1971

CVE-2015-1971 affects IBM Jazz Team Server-based products across CLM, RRC, RDNG, RELM, RTC, RQM, Rhapsody DM, and RSA DM. An unspecified denial-of-service vulnerability exists in Jazz Team Server components used by these products, with affected ranges spanning CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG...

Design/Logic Flaw

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.x before 6.0.0 IF4; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4;...

CVE-2015-1928

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.x before 6.0.0 IF4; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4;...

CVE-2015-1928

CVE-2015-1928 affects IBM Jazz-based CLM ecosystem (Jazz Team Server and multiple CLM apps such as RRC, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.). The connected IBM bulletin confirms a remote attacker can exploit via a crafted website to hijack the victim’s click actions (clickjacking). Af...

CVE-2015-0130

Cross-site scripting XSS vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager RQM 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert RTC 4.x before 4.0....

CVE-2015-0130

CVE-2015-0130 describes a cross-site scripting vulnerability in IBM Jazz Foundation/CLM stack (including CLM, RRC, RDNG, RTC, RQM ). The root cause is improper validation of user-supplied input, allowing remote authenticated users to craft a URL that executes arbitrary script/HTML in the victim’s...

CVE-2015-0112

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...

Xxe

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager RQM 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert RTC 2.0 through...

CVE-2015-0112

CVE-2015-0112 maps to an XML External Entity (XXE) issue in IBM Jazz Foundation/CLM stack (Jazz Team Server and multiple CLM-based products). Affected: CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG 4.x–5.0.2, RELM 1.0/4.0.3–5.0.2, Rhapsody DM 3.0–5.0, RSA DM 3.0–5.0, RTC 2.0–5.0.2, RQM 2.0–5.0.2. Impact: ...

CVE-2015-0113

CVE-2015-0113 affects IBM Jazz-based products (CLM, RTC, RRC, RDNG, RELM, RQM, Rhapsody DM, RSA DM, and related components) where the Jazz Help System permits remote attackers to read JSP source code by sending a crafted request. Affected versions include CLM 4.0–5.0.2, RQM 4.0–4.0.7 and 5.0–5.0....

IBM Collaborative Lifecycle Management Applications远程代码执行漏洞

BUGTRAQ ID: 65900 CVE ID: CVE-2014-0862 Collaborative Lifecycle Management Applications是产品生命周期管理解决方案。 IBM Rational Collaborative Lifecycle Management CLM 3.0.1.6 iFix 2之前版本、4.0.6之前版本中，Jazz Team Server存在安全漏洞，可使远程攻击者利用此漏洞执行任意代码。 0 IBM Collaborative Lifecycle Management Applications 4.x IBM...

IBM Rational Collaborative Lifecycle Management Products Unspecified Remote Code Execution

The version of at least one IBM Rational Collaborative Lifecycle Management component installed on the remote Windows host is 3.x prior to 3.0.1.6 iFix2 or 4.x prior to 4.0.6. It is, therefore, potentially affected by an unspecified remote code execution vulnerability in the Jazz Team Server. C...

CVE-2014-0862

Unspecified vulnerability in Jazz Team Server in IBM Rational Collaborative Lifecycle Management CLM 3.x before 3.0.1.6 iFix 2 and 4.x before 4.0.6 allows remote attackers to execute arbitrary code via unknown vectors...