Design/Logic Flaw

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...

CVE-2016-2981

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...

CVE-2016-2981

The CVE-2016-2981 entry concerns an undisclosed vulnerability in the CLM applications of IBM Jazz Team Server that could allow unauthorized access to user credentials. The IBM bulletin for CLM/Jazz products (Rational Collaboration Lifecycle Management, QMR, RTC, DOORS Next Gen, etc.) lists affect...

CVE-2016-2981

An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference : 1999965...

CVE-2016-2987

An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker...

Design/Logic Flaw

An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker...

CVE-2016-2987

An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker...

CVE-2016-2987

CVE-2016-2987 is an IBM CLM family information-disclosure issue described as an undisclosed vulnerability that could cause some administrative deployment parameters to be shown to an attacker. Connected IBM bulletin confirms affected products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM) and p...

CVE-2016-0273

The CVE-2016-0273 entry applies to IBM Jazz-based CLM suite (and related products: RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM, etc.) with a cross-site scripting vulnerability exploitable by remote authenticated users via a specially crafted URL to inject arbitrary web script/HTML. The root cause i...

CVE-2016-0372

CVE-2016-0372 affects IBM Jazz-based CLM/RTC/RQM and related products. The vulnerability stems from not setting the secure flag on the session cookie in SSL mode, allowing a remote attacker to capture the cookie over HTTP. Impact is cookie exposure, not full remote code execution. Affected versio...

CVE-2016-0284

The CVE-2016-0284 entry relates to an XML External Entity (XXE) vulnerability in the XML parser used by IBM Jazz-based CLM products. Affected products include Rational Collaborative Lifecycle Management (across 3.0.1.6 up to 6.0.2), Rational Quality Manager, Rational Team Concert, Rational DOORS ...

CVE-2015-7468

CVE-2015-7468 concerns IBM Jazz Reporting Service (JRS) as part of Rational Insight. The vulnerability allows remote authenticated users to bypass restrictions on administrator tasks due to improper access control, affecting JRS 5.x up to 5.0.2-Rational-CLM-ifix011 and 6.0 up to 6.0.0-Rational-CL...

CVE-2015-7467

The CVE-2015-7467 issue affects IBM Jazz Reporting Service (JRS) via the Report Builder component. Affected versions are JRS 5.x prior to 5.0.2-Rational-CLM-ifix011 and 6.0 prior to 6.0.0-Rational-CLM-ifix005. The root cause is cross-site scripting (XSS) due to improper validation of user-supplie...

CVE-2015-7469

CVE-2015-7469 affects IBM Jazz Reporting Service (JRS) Report Builder. The vulnerability arises from improper access control: users with JazzGuest roles can manipulate data that should be read-only. Affected versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0. IBM’s bulletin recomme...

CVE-2015-7470

CVE-2015-7470 affects IBM Jazz Reporting Service (JRS) Report Builder in Rational Insight. Affected versions are JRS 5.0/5.0.1/5.0.2 and 6.0 prior to the indicated fixes. The vulnerability enables a man-in-the-middle attacker to obtain sensitive information (e.g., login information) via unspecifi...

CVE-2015-7469

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role...

CVE-2015-4962

Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team...

Design/Logic Flaw

Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management CLM 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager RQM 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x...

CVE-2015-4962

CVE-2015-4962 affects IBM Jazz-based CLM ecosystem (including CLM, RTC, RQM, RRC, RDNG, RELM, Rhapsody DM, RSA DM, etc.). The root cause is weak permissions on unspecified project areas, allowing remote authenticated users to obtain sensitive information via unknown vectors. Impact is information...

CVE-2015-4946

CVE-2015-4946 affects IBM CLM/Jazz-based products (RCLM, RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM) and related Jazz Team Server components. The issue allows an authenticated user to bypass access restrictions and perform unauthorized actions due to a design/logic flaw in IBM Rational LifeCy...