Security Bulletin: Encrypted passwords field available in result set of User record type (CVE-2012-2165)

Summary The encrypted password field for a user is available to IBM Rational ClearQuest queries and can be displayed in a result set. This is an information disclosure that may assist an attacker in attempts to construct passwords that match that encrypted value. Vulnerability Details | Subscribe...

Security Bulletin: SQL Injection for IBM Rational ClearQuest Maintenance tool (CVE-2011-1390)

Summary The IBM Rational ClearQuest Maintenance tool on Microsoft Windows platforms contains a feature to upgrade the user database. This feature is subject to a SQL Injection attack. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like thi...

Security Bulletin: Rational ClearQuest CQOle ActiveX Control Remote Execution Vulnerability (CVE-2012-0708)

Summary A defect has been discovered where an IBM Rational ClearQuest Ole API function can be called with incorrect parameters causing a crash or possible execution of attack code. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this...

Security Bulletin: Potential Denial of Service security vulnerability in Rational ClearCase and Rational ClearQuest running on WAS or eWAS due to Java HashTable implementation vulnerability (CVE-2012-0193)

Summary Products bundled with an embedded IBM WebSphere Application Server eWAS or IBM WebSphere Application Server WAS are subject to a potential security exposure due to the Java HashTable implementation which can result in a Denial of Service DoS exposure when using Web based applications such...

IBM Rational ClearQuest Multiple Component XML External Entity Injection Vulnerability

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle.CQWeb/CM Server, etc. are components...

CVE-2014-0950

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

Xxe

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

CVE-2014-0950

Concrete details found: CVE-2014-0950 affects IBM Rational ClearQuest components (CQWeb/CM Server, ClearQuest Native client, ClearQuest Eclipse client, ClearQuest Eclipse Designer). The root cause is XML External Entity (XXE) processing allowing remote attackers to cause a denial of service or ac...

CVE-2014-0950

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

IBM Rational ClearQuest Information Disclosure Vulnerability

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle. A security vulnerability exists in...

CVE-2015-4996

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

Design/Logic Flaw

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

CVE-2015-4996

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

CVE-2015-4996

IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors...

CVE-2015-4996

CVE-2015-4996 affects IBM Rational ClearQuest 7.1.x and 8.0.0.x (before 8.0.0.17) and 8.0.1.x (before 8.0.1.10). A local attacker can trick the application into connecting to a fake database server to obtain credentials. Impact: credential disclosure without remote access. Remediation: upgrade to...

CVE-2014-8925

Cross-site request forgery CSRF vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences...

CVE-2014-8925

CVE-2014-8925 is a CSRF vulnerability in IBM Rational ClearQuest Web. It affects IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7. The issue is caused by improper validation in the DoLogout action, allowing an authenticated user to be logged out v...

CVE-2014-8925

Cross-site request forgery CSRF vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences...

IBM Rational ClearQuest Cross-Site Request Forgery Vulnerability (CNVD-2015-01981)

IBM Rational ClearQuest is a suite of Application Lifecycle Management ALM software from IBM, USA. The software provides defect tracking, process customization, and real-time reporting for applications to improve visibility and control of the development cycle. A cross-site request forgery...