EUVD-2008-3536

Malware in sbrugna...

Xxe

Multiple XML external entity XXE vulnerabilities in 1 CQWeb / CM Server, 2 ClearQuest Native client, 3 ClearQuest Eclipse client, and 4 ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1....

IBM Rational ClearQuest CQWeb界面口令信息泄露漏洞

BUGTRAQ ID: 37385 CVE ID: CVE-2009-4357 IBM Rational ClearQuest是全面的软件变更、追踪管理解决方案。 IBM Rational ClearQuest的CQWeb界面没有正确地处理自动登录所遗漏的URL，远程攻击者可以从中获取账号的口令信息。 IBM Rational ClearQuest 7.1 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www-01.ibm.com/support/docview.wss?uid=swg1PK86377...

Design/Logic Flaw

CQWeb aka the web interface in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors...

IBM Rational ClearQuest Multiple XSS Flaws

IBM Rational ClearQuest CQWeb Server is installed on the remote host. The installed version is affected by multiple cross-site scripting flaws. Specifically, the application fails to sanitize input passed to parameter 'contextid', 'schema', 'userNameVal' and 'username' before using it to generate...

Default credentials

The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows attackers to discover a 1 username or 2 password via unspecified vectors...

CVE-2009-2212

The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows attackers to discover a 1 username or 2 password via unspecified vectors...

CVE-2009-2211

Cross-site scripting XSS vulnerability in the CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2211

Cross-site scripting XSS vulnerability in the CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2212

The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows attackers to discover a 1 username or 2 password via unspecified vectors...

CVE-2009-2212

CVE-2009-2212 affects the CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5, where an attacker can discover a user’s credentials (username or password) via unspecified vectors. The published description does not specify the exact exploit path or affected compon...

Cross site scripting

The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information page source code via a combination of ?script? and ?/script? sequences in the id field, possibly related to a cross-site scripting XSS vulnerability...

CVE-2008-3550

The CVE-2008-3550 entry affects IBM Rational ClearQuest 7.0.1 CQWeb: the login page may reveal potentially sensitive information (page source code) via crafted id field input using ?script? and ?/script? sequences, indicating a cross-site scripting (XSS) issue. The issue is described consistently...