581 matches found
Design/Logic Flaw
IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to interfere with intended record relationships, and possibly cause a denial of service loop or have...
CVE-2010-4602
The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a modified bookmark...
CVE-2010-4603
IBM Rational ClearQuest is affected by CVE-2010-4603: specific releases (7.0.x before 7.0.1.11; 7.1.1.x before 7.1.1.4; 7.1.2.x before 7.1.2.1) do not prevent modification of back-reference fields. This allows remote authenticated users to interfere with intended record relationships by adding or...
CVE-2010-4600
CVE-2010-4600 affects IBM Rational ClearQuest Web Client using Dojo Toolkit: versions 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 expose cookie data to remote attackers who navigate to a Dojo file via an related “open direct” issue. The vulnerability is an information disclosure in the Dojo...
CVE-2010-4600
Dojo Toolkit, as used in the Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1, allows remote attackers to read cookies by navigating to a Dojo file, related to an "open direct" issue...
CVE-2010-4603
IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to interfere with intended record relationships, and possibly cause a denial of service loop or have...
CVE-2010-4601
Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 allow attackers to have an unknown impact via vectors related to third-party .ocx files...
CVE-2010-4601
CVE-2010-4601 affects IBM Rational ClearQuest versions: 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1. The vulnerabilities enable unknown impact via vectors related to third-party .ocx files. Vulnerable components/versions are identified in the initial description; the...
CVE-2010-4602
IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 contains a web client vulnerability that allows remote authenticated users to bypass the “restricted user” restrictions and read arbitrary records by modifying the record number in the URL for a RECORD action (e.g., via a b...
CVE-2010-2517
Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report...
Code injection
Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report...
CVE-2010-2517
Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report...
CVE-2010-2517
CVE-2010-2517 affects IBM Rational ClearQuest prior to 7.1.1.02. The connected sources provide no concrete root cause or exploit details beyond “multiple unspecified vulnerabilities” demonstrated by an AppScan report. The CVSS/metrics in the NVD entry indicate a Network attack vector with low com...
IBM Rational ClearQuest CQWeb界面口令信息泄露漏洞
BUGTRAQ ID: 37385 CVE ID: CVE-2009-4357 IBM Rational ClearQuest是全面的软件变更、追踪管理解决方案。 IBM Rational ClearQuest的CQWeb界面没有正确地处理自动登录所遗漏的URL，远程攻击者可以从中获取账号的口令信息。 IBM Rational ClearQuest 7.1 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377...
CVE-2009-4357
CQWeb aka the web interface in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors...
CVE-2009-4357
CQWeb aka the web interface in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors...
CVE-2009-4357
CVE-2009-4357 affects IBM Rational ClearQuest CQWeb (the web interface) prior to version 7.1.1. The root cause is improper handling of legacy URLs used for automatic login, which could allow remote attackers to discover user passwords through unspecified vectors. Affected component: CQWeb web int...
IBM Rational ClearQuest Multiple XSS Flaws
IBM Rational ClearQuest CQWeb Server is installed on the remote host. The installed version is affected by multiple cross-site scripting flaws. Specifically, the application fails to sanitize input passed to parameter 'contextid', 'schema', 'userNameVal' and 'username' before using it to generate...
CVE-2009-2211
Cross-site scripting XSS vulnerability in the CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...