Design/Logic Flaw

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

CVE-2017-1238

The CVE-2017-1238 entry concerns IBM Rational Quality Manager (RQM) versions 5.0.x and 6.0 up to 6.0.5, where the Web UI is vulnerable to cross-site scripting. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and exposing credentials within a truste...

CVE-2017-1239

The CVE-2017-1239 issue affects IBM Rational Quality Manager (RQM) components in Rational CLM: 5.0.x and 6.0.x up to 6.0.5. The vulnerability allows sensitive information exposure via HTTP 500 Internal Server Error responses, as described in IBM’s Security Bulletin for RQM. Root cause details are...

CVE-2017-1242

IBM Security Bulletin confirms CVE-2017-1242 affects IBM Rational Quality Manager (RQM) in Rational CLM 5.0–5.0.2 and 6.0–6.0.5. The issue is an HTML injection that lets a remote attacker have HTML execute in a user’s browser in the hosting site’s context. Remediation: upgrade to RQM 6.0.4+ (or 6...

CVE-2017-1329

IBM Quality Manager (RQM) is affected by an HTML injection vulnerability identified as CVE-2017-1329. Affected: Rational Quality Manager 5.0.x and 6.0–6.0.5; the issue allows remote HTML injection executed in the browser within the hosting site’s security context. Remediation: upgrade 6.0.x to 6....

CVE-2017-1248

CVE-2017-1248 affects IBM Rational Quality Manager (RQM) 5.0.x and 6.0–6.0.5, with an HTML injection flaw that could execute code in a user’s browser within the hosting site’s context. The IBM bulletin A27047ED73E7AE4D822B59EB4E55C43E9EF28F36E8CF4AFFCD62BFF92FCC5593 lists this CVE among multiple ...

PT-2018-5568

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x through 6.0.5 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2017-1248: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

CVE-2017-1329: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 126231...

CVE-2017-1239: Exposure of Sensitive Information to an Unauthorized Actor

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124357...

CVE-2017-1238: Improper Neutralization of Input During Web Page Generation

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

PT-2018-5397

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue could reveal sensitive information in HTTP 500 Internal Server Error responses. Recommendations: For versions 5.0.x, update to a version that does not have th...

PT-2018-5395

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

CVE-2017-1242: Improper Control of Generation of Code

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

PT-2018-5413

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x through 6.0.5 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

PT-2018-5401

Name of the Vulnerable Software and Affected Versions: IBM Quality Manager RQM versions 5.0.x and 6.0 through 6.0.5 Description: The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the...

CVE-2017-1608

IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2017-1294

CVE-2017-1294 is a cross-site scripting vulnerability in IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) affecting 5.0–5.0.2 and 6.0–6.0.5. The Web UI can embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Reme...

CVE-2017-1651

CVE-2017-1651 affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5, with a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a ...