CVE-2008-3550: Exposure of Sensitive Information to an Unauthorized Actor

The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information page source code via a combination of ?script? and ?/script? sequences in the id field, possibly related to a cross-site scripting XSS vulnerability...

IBM Rational ClearQuest多个参数跨站脚本漏洞

BUGTRAQ ID: 28296 CVECAN ID: CVE-2007-4592 IBM Rational ClearQuest是全面的软件变更、追踪管理解决方案。 Rational ClearQuest没有正确地验证对contextid、schema、userNameVal、username变量的输入参数，允许远程攻击者通过提交特制的URL请求执行跨站脚本攻击。 IBM Rational ClearQuest 7.0.1.0iFix01 IBM Rational ClearQuest 7.0.0.1iFix04 IBM Rational ClearQuest 2003.06.16...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2iFix01, and 7.0.1.1iFix01 allow remote attackers to inject arbitrary web script or HTML via the 1 contextid, 2 username, 3 userNameVal, and 4 schema parameters ...

CVE-2007-4592

Multiple cross-site scripting XSS vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2iFix01, and 7.0.1.1iFix01 allow remote attackers to inject arbitrary web script or HTML via the 1 contextid, 2 username, 3 userNameVal, and 4 schema parameters ...

CVE-2007-4592

Multiple cross-site scripting XSS vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2iFix01, and 7.0.1.1iFix01 allow remote attackers to inject arbitrary web script or HTML via the 1 contextid, 2 username, 3 userNameVal, and 4 schema parameters ...

CVE-2007-4592

CVE-2007-4592 concerns multiple XSS flaws in IBM Rational ClearQuest CQWeb/Web login interface. The web UI fails to sanitize input for parameters (contextid, username, userNameVal, schema), enabling remote attackers to inject arbitrary HTML/JS that runs in the victim’s browser. Affected products ...

CVE-2007-4592: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2iFix01, and 7.0.1.1iFix01 allow remote attackers to inject arbitrary web script or HTML via the 1 contextid, 2 username, 3 userNameVal, and 4 schema parameters ...

IBM Rational ClearQuest crossite scripting

Multiple crossite scripting conditions...

IBM Rational ClearQuest Web Multiple XSS Vulnerabilities

IBM Rational ClearQuest Web Multiple XSS CVE-2007-4592 Discovered on 07-24-07 by sasquatch of SecureState - www.securestate.com Multiple cross site scripting vulnerabilities exist within IBM's Rational ClearQuest Web interface. VULNERABLE VARIABLES: ===================== contextid query string...

ibmrational-xss.txt

IBM Rational ClearQuest Web Multiple XSS CVE-2007-4592 Discovered on 07-24-07 by sasquatch of SecureState - www.securestate.com Multiple cross site scripting vulnerabilities exist within IBM's Rational ClearQuest Web interface. VULNERABLE VARIABLES: ===================== contextid query string...

IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities

IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/28296/info IBM Rational ClearQuest is prone to multiple cross-site scripting vulnerabilities because it fails to adequately sanitize user-supplied input. An attacker could exploit...

IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/28296/info IBM Rational ClearQuest is prone to multiple cross-site scripting vulnerabilities because it fails to adequately sanitize user-supplied input. An attacker could exploit these vulnerabilities to execute arbitrary local or remote script code in t...

Code injection

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...

Code injection

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies...

CVE-2008-1288

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies...

CVE-2008-1287

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...

CVE-2008-1287

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...

CVE-2008-1288

IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies...

CVE-2008-1287

Technical details about CVE-2008-1287 are not publicly provided in the supplied documents. Monitor for updates; current sources summarize a username enumeration issue in IBM Rational ClearQuest without further technical specifics.

CVE-2008-1288

IBM Rational ClearQuest versions 7.0.1.1 and 7.0.0.2 are affected by a vulnerability that could allow local or remote attackers to obtain sensitive information about users by reading user cookies. The connected sources confirm the affected product/version and the impact tied to cookie leakage, bu...