CVE-2012-0730

Multiple cross-site request forgery CSRF vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2012-0732

The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2012-0737

CVE-2012-0737 describes a cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise, impacting versions 5.x and 8.x before 8.5.0.1. The flaw allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. The provided documents do not specify th...

CVE-2012-0729

Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and then accessing it via unspecified vectors...

PT-2012-2827

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted URI, due to improper scanning ...

PT-2012-2826

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job, due to improper job...

PT-2012-2822

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts due to multiple cross-site reques...

CVE-2012-0730: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2012-0734: Undefined Security Weakness

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job...

CVE-2012-0733: Undefined Security Weakness

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1, when Integrated Windows authentication is used, allows remote authenticated users to obtain administrative privileges by hijacking a session associated with the service account...

CVE-2012-0729: Undefined Security Weakness

Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and then accessing it via unspecified vectors...

CVE-2012-0736: Improper Input Validation

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2012-0732: Undefined Security Weakness

The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2012-2821

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file. This can be achieved by accessing the uploaded file via...

CVE-2012-0735: Improper Input Validation

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly scan file: URLs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted URI...

PT-2012-2823

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows remote authenticated users to read arbitrary files via unspecified vectors due to the lack of prevention of service-account impersonation...

PT-2012-2825

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows remote authenticated users to obtain administrative privileges by hijacking a session associated with the service account when Integrated Windows...

PT-2012-2824

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x and 8.x before 8.5.0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, due to the Enterprise Console client not...

PT-2012-2829

Name of the Vulnerable Software and Affected Versions IBM Rational AppScan Enterprise versions 5.x through 8.x before 8.5.0.1 IBM Rational AppScan Enterprise version 8.x before 8.5.0.1 can be consolidated into the previous line, so it is omitted to avoid duplication. Description A cross-site...

CVE-2012-0731: Exposure of Sensitive Information to an Unauthorized Actor

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors...