CVE-2016-0317

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-0316

Cross-site scripting XSS vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-0317

The CVE-2016-0317 issue affects IBM Jazz Reporting Service’s Lifecycle Query Engine (LQE) shipped with Jazz Reporting Service 6.0 and 6.0.1 (prior to 6.0.1 iFix006). The vulnerability enables remote attackers to hijack click actions (clickjacking) via unspecified vectors. The IBM advisory groups ...

CVE-2016-0318

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-0319: Improper Access Control

The XML parser in Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity...

PT-2016-4143

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0 through 6.0.1 before 6.0.1 iFix006 Description The issue allows remote attackers to obtain access by leveraging an unattended workstation due to the failure of the Lifecycle Query Engine LQE to destroy a...

CVE-2016-0317: Improper Access Control

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-0318: Improper Access Control

Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-0316: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

PT-2016-4144

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0 through 6.0.1 before 6.0.1 iFix006 Description The issue concerns an XML External Entity XXE problem in the XML parser of the Lifecycle Query Engine LQE in IBM Jazz Reporting Service. This allows remote...

PT-2016-4141

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service versions 6.0 through 6.0.1 before 6.0.1 iFix006 IBM Jazz Reporting Service version 6.0.2 before iFix003 Description A cross-site scripting XSS issue in the Lifecycle Query Engine LQE of IBM Jazz Reporting Service...

IBM Jazz Reporting Service Lifecycle Query Engine Cross-Site Request Forgery Vulnerability

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in conjunction with IBM Rational CLM's Rational solution for managing all the lifecycles of a development project. CLM users can access JRS-provided reports from a dashboard th...

IBM Jazz Reporting Service Lifecycle Query Engine LDAP Injection Vulnerability

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in conjunction with IBM Rational CLM's Rational solution for managing all the lifecycles of a development project. CLM users can access JRS-provided reports from a dashboard th...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-7465: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-7466: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

CVE-2015-7465

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. Recent assessments: Assesse...

PT-2016-3788

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS version 6.0 before 6.0.0-Rational-CLM-ifix005 Description A cross-site request forgery CSRF issue in the Lifecycle Query Engine LQE of IBM Jazz Reporting Service JRS allows remote authenticated users to hijack th...

CVE-2013-6717

The OLAP query engine in IBM DB2 and DB2 Connect 9.7 through FP9, 9.8 through FP5, 10.1 through FP3, and 10.5 through FP2, and the DB2 pureScale Feature 9.8 for Enterprise Server Edition, allows remote authenticated users to cause a denial of service database outage and deactivation via unspecifi...