CVE-2019-4603: Incorrect Permission Assignment for Critical Resource

IBM Quality Manager RQM 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. IBM X-Force ID: 168295...

CVE-2019-4602: Improper Neutralization of Input During Web Page Generation

IBM Quality Manager RQM 6.02, 6.06, and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2019-4601: Generation of Error Message Containing Sensitive Information

IBM Quality Manager RQM 6.02, 6.06, and 6.0.6.1 could allow an authenticated user to obtain sensitive information from a stack trace that could aid in further attacks against the system...

PT-2020-10988

Name of the Vulnerable Software and Affected Versions IBM Quality Manager RQM versions 6.02 through 6.0.6.1 Description The issue allows an authenticated user to create keywords through the REST API and have them appear as if they were created by another user. Recommendations For versions 6.02...

PT-2020-10987

Name of the Vulnerable Software and Affected Versions IBM Quality Manager RQM versions 6.02 through 6.0.6.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2018-6118

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0 through 5.0.2 IBM Quality Manager RQM versions 6.0 through 6.0.6 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially...

CVE-2017-1609: Improper Neutralization of Input During Web Page Generation

IBM Quality Manager RQM 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2018-5401

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the...

PT-2018-5395

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2018-5568

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x through 6.0.5 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

PT-2018-5397

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue could reveal sensitive information in HTTP 500 Internal Server Error responses. Recommendations: For versions 5.0.x, update to a version that does not have th...

PT-2018-5413

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x through 6.0.5 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2017-1329: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 126231...

CVE-2017-1248: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

CVE-2017-1239: Exposure of Sensitive Information to an Unauthorized Actor

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357...

CVE-2017-1238: Improper Neutralization of Input During Web Page Generation

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2017-1242: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

PT-2017-11674

Name of the Vulnerable Software and Affected Versions IBM Quality Manager RQM versions 4.0 through 6.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...

PT-2017-11679

Name of the Vulnerable Software and Affected Versions IBM Quality Manager RQM versions 4.0 through 6.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...

PT-2017-11701

Name of the Vulnerable Software and Affected Versions IBM Quality Manager RQM versions 4.0 through 6.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...