CVE-2012-0729

The CVE concerns an unrestricted file upload in IBM Rational AppScan Enterprise (versions 5.x and 8.x prior to 8.5.0.1). The underlying issue allows remote authenticated users to upload a .aspx file and subsequently access it through unspecified vectors to execute arbitrary ASP.NET code. Affected...

CVE-2012-0737

Cross-site scripting XSS vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0731

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2012-0732

The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2012-0733

CVE-2012-0733 affects IBM Rational AppScan Enterprise versions 5.x and 8.x prior to 8.5.0.1. When Integrated Windows authentication is enabled, remote authenticated users can hijack a session associated with the service account to obtain administrative privileges. The issue is rooted in how sessi...

CVE-2012-0733: Undefined Security Weakness

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1, when Integrated Windows authentication is used, allows remote authenticated users to obtain administrative privileges by hijacking a session associated with the service account...

CVE-2012-0730: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for requests that create administrative accounts...

CVE-2012-0732: Undefined Security Weakness

The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2012-0737: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0729: Undefined Security Weakness

Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and then accessing it via unspecified vectors...

CVE-2012-0735: Improper Input Validation

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly scan file: URLs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted URI...

CVE-2012-0731: Exposure of Sensitive Information to an Unauthorized Actor

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2012-0736: Improper Input Validation

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site...

CVE-2012-0734: Undefined Security Weakness

IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job...

IBM Rational AppScan企业平台验证代码执行漏洞

Bugtraq ID: 53247 CVE ID：CVE-2012-0736 IBM Rational AppScan是一款Web应用的安全测试工具，可以在开发生命周期中进行自动化动态和静态安全漏洞扫描。 IBM Rational AppScan企业版在某些配置下创建扫描作业时存在错误，允许远程攻击者执行任意代码。诱使用户扫描恶意WEB站，可在目标用户系统上执行任意代码。 0 IBM Rational Policy Tester 8.5 IBM Rational AppScan Reporting Console 8.0.1.1 IBM Rational AppScan Reportin...

CVE-2011-1367

Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file...

CVE-2011-1366

Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive...

Design/Logic Flaw

Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive...

Design/Logic Flaw

Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file...

CVE-2011-1366

CVE-2011-1366 affects IBM Rational AppScan Enterprise and AppScan Reporting Console versions 5.2 through 7.9.x and 8.x prior to 8.0.1.1. The issue is described as an unspecified vulnerability in the Import feature that lets remote attackers execute arbitrary commands on an agent server via a craf...