Security Bulletin: ClearQuest Cross-Site Scripting (XSS) Vulnerability (CVE-2012-5757)

Summary IBM Rational ClearQuest Web client contains a Cross-Site Scripting vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVE ID:...

Security Bulletin: A security vulnerability has been identified in IBM Rational ClearQuest (CVE-2015-4996)

Summary A vulnerability was discovered in IBM Rational ClearQuest that allows an attacker to obtain the database login credentials. Vulnerability Details CVEID: CVE-2015-4996 DESCRIPTION: IBM ClearQuest could allow an attacker to trick it into connecting to a fake database server which would be...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2015-3196, CVE-2015-3193, CVE-2015-3194, CVE-2015-3195)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3196 DESCRIPTION: OpenSSL is vulnerable to a denial of service,...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2016-0702)

Summary An OpenSSL vulnerability was disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain...

Security Bulletin: Vulnerabilities in ClearQuest OpenSSL Component (CVE-2013-4353, CVE-2013-6450, CVE-2013-6449 )

Summary The OpenSSL commponent is embedded in cqperl. Customers may be affected when there are Perl hooks/scripts which use SSL connections. ClearQuest itself doesn't provide any services using OpenSSL. Vulnerability Details | Subscribe to My Notifications to be notified of important product...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational ClearQuest (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes “FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by cqperl and ratlperl for SSL communications. Rational ClearQuest has addressed the...

Security Bulletin: Vulnerabilities in IBM Rational ClearQuest (CVE-2014-8925)

Summary A cross site request forgery vulnerability was discovered and fixed in IBM Rational ClearQuest. An attacker may trigger a premature logout of a user, causing any work in progress to be lost. Vulnerability Details CVEID: CVE-2014-8925 DESCRIPTION: IBM Rational ClearQuest is vulnerable to...

Security Bulletin: Rational ClearQuest is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-3470, CVE-2015-0292

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. The OpenSSL component is shipped as embedded in cqperl. Customers might be affected when there is perl hooks or scripts that are using SSL connections. ClearQuest itself doe...

MS11-049: Description of the security update for SQL Server 2008 Service Pack 2 QFE: June 14, 2011

MS11-049: Description of the security update for SQL Server 2008 Service Pack 2 QFE: June 14, 2011 Summary Microsoft has released security bulletin MS11-049. To view the complete security bulletin, visit the following Microsoft...

Security Bulletin: IBM DataPower Gateways management interface is affected by a vulnerability (CVE-2018-1664)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1664 Vulnerability Details CVEID: CVE-2018-1664 DESCRIPTION: IBM DataPower Gateways echoing of AMP management interface authorization headers exposes login credentials in browser cache. CVSS Base Score: 6.2 CVSS...

Security Bulletin: IBM DataPower Gateways is affected by an XXE vulnerability (CVE-2018-1669)

Summary IBM DataPower Gateways has addressed the following vulnerability: CVE-2018-1669 Vulnerability Details CVEID: CVE-2018-1669 DESCRIPTION: IBM DataPower Gateways is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this...

Immunity Canvas: COLDFUSION_RCE

Name| coldfusionrce ---|--- CVE| CVE-2018-15957 Exploit Pack| CANVAS Description| CVE-2018-15957 Notes| CVE Name: CVE-2018-15957 VENDOR: Oracle NOTES: This exploit will work against ColdFusion 2018 update 1, ColdeFusion 2016 = update 6 and ColdFusion 11 = update 14. Repeatability: Infinite...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2018-1683)

Summary There is a potential information disclosure vulnerability in WebSphere Application Server Liberty. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encry...

Elastic Cloud Enterprise (ECE) Information Disclosure Vulnerability

Elastic Cloud Enterprise ECE is a suite of software packages for managing, monitoring, and configuring Elasticsearch, Kibana, and X-Pack from Elasticsearch Netherlands. An information disclosure vulnerability exists in Elastic Cloud Enterprise ECE, which can be exploited by an attacker to obtain...

Microsoft Exchange Server Rollup Server-Side Request Forgery Vulnerability

Microsoft Exchange Server is the United States Microsoft Microsoft a set of e-mail services program, which provides mail access, storage, forwarding, voice mail, mail filtering and screening functions.Rollup is used in one of the code packer. A server-side request forgery vulnerability exists in...

Elastic X-Pack Machine Learning Cross-Site Scripting Vulnerability

Elastic X-Pack is an extension of the Elastic Stack log analytics system from Elasticsearch in the Netherlands.X-Pack Machine Learning is one of the machine learning components. A cross-site scripting vulnerability in Elastic X-Pack Machine Learning versions prior to 6.2.4 and prior to 5.6.9 can ...

Security Bulletin: Potential MITM attack in Apache CXF used by WebSphere Application Server (CVE-2018-8039)

Summary There is a potential man-in-the-middle attack in Apache CXF used by WebSphere Application Server CVE-2018-8039 Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote attacker to conduct a man-in-the-middle attack. The TLS hostname verification does not wor...

CVE-2018-3824

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...

CVE-2018-3824

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive...

CVE-2018-3823

X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting XSS vulnerability. Users with manageml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructiv...