Security Bulletin: Information Disclosure ClearQuest Web stack traces (CVE-2012-2168)

Summary IBM Rational ClearQuest Web sometimes displays stack trace information in error messages. This is considered an information disclosure that may be assistance to attackers in crafting their attacks. Vulnerability Details | Subscribe to My Notifications to be notified of important product...

Security Bulletin: ClearQuest Web parameter tampering to elevated privileges (CVE-2012-2164)

Summary The IBM Rational ClearQuest Web client is subject to an elevated privileges attack. This allows an attacker to access the Site Administration menu. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more...

Security Bulletin: ClearQuest Web leftover scripts (CVE-2012-0744)

Summary The IBM ClearQuest web server deployment into IBM WebSphere Application Server also installs some sample scripts. These are unnecessary and may provide information disclosure that could assist an attacker. Vulnerability Details | Subscribe to My Notifications to be notified of important...

Security Bulletin: ClearQuest Cross-Site Scripting (XSS) Vulnerability (CVE-2012-2205)

Summary IBM Rational ClearQuest Web client contains a Cross-Site Scripting vulnerability. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with your IBM ID ---|--- CVE ID:...

Security Bulletin: ClearQuest Help System Open Redirect (CVE-2012-2159)

Summary Some scripts inside the IBM Rational ClearQuest web help application are vulnerable to Open Redirect attacks. Exploiting this vulnerability allows an attacker to provide a link to the victim which directs to the trusted website. If the user visits the link to the trusted website, the user...

Security Bulletin: ClearQuest Help System cross-site scripting (CVE-2012-2161)

Summary The IBM Rational ClearQuest Help component contains a reflected Cross-Site Scripting vulnerability. With reflected cross-site scripting, an attacker can inject arbitrary HTML or JavaScript code into the victim's web browser. The victim has to click a malicious link; the attacker's code is...

Security Bulletin: Encrypted passwords field available in result set of User record type (CVE-2012-2165)

Summary The encrypted password field for a user is available to IBM Rational ClearQuest queries and can be displayed in a result set. This is an information disclosure that may assist an attacker in attempts to construct passwords that match that encrypted value. Vulnerability Details | Subscribe...

Security Bulletin: SQL Injection for IBM Rational ClearQuest Maintenance tool (CVE-2011-1390)

Summary The IBM Rational ClearQuest Maintenance tool on Microsoft Windows platforms contains a feature to upgrade the user database. This feature is subject to a SQL Injection attack. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like thi...

Security Bulletin: Rational ClearQuest CQOle ActiveX Control Remote Execution Vulnerability (CVE-2012-0708)

Summary A defect has been discovered where an IBM Rational ClearQuest Ole API function can be called with incorrect parameters causing a crash or possible execution of attack code. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this...

Security Bulletin: Potential Denial of Service security vulnerability in Rational ClearCase and Rational ClearQuest running on WAS or eWAS due to Java HashTable implementation vulnerability (CVE-2012-0193)

Summary Products bundled with an embedded IBM WebSphere Application Server eWAS or IBM WebSphere Application Server WAS are subject to a potential security exposure due to the Java HashTable implementation which can result in a Denial of Service DoS exposure when using Web based applications such...

IBM Rational ClearQuest Multiple Component XML External Entity Injection Vulnerability

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle.CQWeb/CM Server, etc. are components...

Xxe

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

CVE-2014-0950

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

CVE-2014-0950

Concrete details found: CVE-2014-0950 affects IBM Rational ClearQuest components (CQWeb/CM Server, ClearQuest Native client, ClearQuest Eclipse client, ClearQuest Eclipse Designer). The root cause is XML External Entity (XXE) processing allowing remote attackers to cause a denial of service or ac...

CVE-2014-0950

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

IBM Rational ClearQuest Information Disclosure Vulnerability

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle. A security vulnerability exists in...

CVE-2015-4996

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

CVE-2015-4996

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

Design/Logic Flaw

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

CVE-2015-4996

CVE-2015-4996 affects IBM Rational ClearQuest 7.1.x and 8.0.0.x (before 8.0.0.17) and 8.0.1.x (before 8.0.1.10). A local attacker can trick the application into connecting to a fake database server to obtain credentials. Impact: credential disclosure without remote access. Remediation: upgrade to...