Cross site scripting

Cross-site scripting XSS vulnerability in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM...

CVE-2015-7474

CVE-2015-7474 is a stored cross-site scripting vulnerability in the IBM Jazz Foundation / Rational Engineering Lifecycle Manager (RELM) affecting multiple CLM components. A remote attacker can inject arbitrary web script or HTML via unspecified vectors, potentially stealing cookies or session dat...

CVE-2015-7484

IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1 and 4.0 before 4.0.7 iFix10 allow remote authenticated users with access to lifecycle projects to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. IBM X-Force ID: 108619...

CVE-2015-7474

Cross-site scripting XSS vulnerability in Jazz Foundation in IBM Rational Engineering Lifecycle Manager 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote attackers to inject arbitrary web script or HTML via unspecifi...

CVE-2015-7485

IBM CVE-2015-7485 is an XSS vulnerability in IBM Rational Engineering Lifecycle Manager across multiple releases (3.0.1.6 iFix7 Interim Fix 1; 4.0.7 iFix10; 5.0.2 iFix15; 6.0.1 iFix4) caused by improper validation of user-supplied input. A remote attacker can craft a URL to execute script in the ...

CVE-2015-7484

IBM Rational Engineering Lifecycle Manager is affected by CVE-2015-7484. The issue allows an authenticated user with project access to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. Root cause is an information-disclosure path via LQE; impact is partial confi...

CVE-2015-7486

CVE-2015-7486 is a cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager (RELM) affecting multiple CLM-related products. The issue stems from improper validation of user-supplied input, allowing remote attackers to inject arbitrary web script or HTML via unspecifi...

IBM Security Key Lifecycle Manager Path Traversal Vulnerability

IBM Security Key Lifecycle Manager formerly known as Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A path traversal vulnerability exists...

Sql injection

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637...

CVE-2017-1671

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 133638...

Design/Logic Flaw

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 133638...

CVE-2017-1668

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a us...

CVE-2017-1668

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a us...

Xxe

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540...

CVE-2017-1666

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540...

CVE-2017-1666

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540...

Open redirect

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a us...

CVE-2017-1670

IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637...

CVE-2017-1668

IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager) is affected by CVE-2017-1668 due to an open redirect vulnerability that can be exploited by persuading a user to visit a crafted site, allowing URL spoofing and potential access to sensitive information. Affected versions:...

CVE-2017-1666

IBM Security Key Lifecycle Manager (formerly Tivoli Key Lifecycle Manager) versions 2.5–2.5.0.8, 2.6–2.6.0.3, and 2.7–2.7.0.2 are affected by a XML External Entity (XXE) vulnerability when processing XML data. The root cause is an XXE flaw in XML processing, allowing a remote attacker to potentia...