PT-2022-9933

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Quality Assistant On-Premises All versions Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

PT-2022-10787

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Quality Assistant On-Premises All versions Description The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery...

CVE-2021-29799: Undefined Security Weakness

IBM Engineering Requirements Quality Assistant On-Premises All versions could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738...

PT-2022-9935

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Quality Assistant On-Premises All versions Description The issue is related to improper client-side validation, which could allow an authenticated user to obtain sensitive information. Recommendations For all...

IBM Engineering Requirements Quality Assistant Cross-site Request Forgery Vulnerability

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM to assist developers in improving the quality of engineering requirements. The application can significantly reduce the cost of finding defects, facilitate the early detection of requirements errors in the...

CVE-2021-29788: Improper Neutralization of Input During Web Page Generation

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2021-38868: Cross-Site Request Forgery (CSRF)

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force Id: 208310...

IBM Engineering Lifecycle Optimization Cross-Site Scripting Vulnerability (CNVD-2022-55503)

IBM Engineering Lifecycle Optimization ELO is an extension of the Engineering Lifecycle Management ELM portfolio from IBM America. They make it easier to collect and analyze data across the development environment to make better decisions. Automate reporting to ensure that the entire organization...

PT-2022-9934

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Quality Assistant On-Premises All versions Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

IBM Engineering Requirements Quality Assistant security vulnerabilities

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM USA used to assist developers in improving the quality of engineering requirements. The application significantly reduces the cost of finding defects, facilitates early detection of requirements errors in the...

IBM Engineering Requirements Quality Assistant Cross-site Scripting Vulnerability

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM to assist developers in improving the quality of engineering requirements. All versions of IBM Engineering Requirements Quality Assistant are vulnerable to a cross-site scripting vulnerability that stems from a...

CVE-2021-29790: Improper Neutralization of Input During Web Page Generation

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2022-0778, CVE-2021-38868, CVE-2021-29799, CVE-2021-29790, CVE-2021-29788)

Summary IBM Engineering Requirements Quality Assistant On-Premises affected by multiple vulnerabilites including OpenSSL, cross-site scripting, cross-site request forgery CVE-2022-0778, CVE-2021-38868, CVE-2021-29799, CVE-2021-29790, CVE-2021-29788 which allowed an attacker or an unauthenticated...

CVE-2021-38868

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force Id: 208310...

CVE-2021-29799

IBM Engineering Requirements Quality Assistant On-Premises All versions could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738...

CVE-2021-29788

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2021-29790

IBM Engineering Requirements Quality Assistant On-Premises All versions is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2021-39019

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could disclose highly sensitive information through an HTTP GET request to an authenticated user. IBM X-Force ID: 213728...

CVE-2021-39017

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to upload arbitrary files, caused by improper access controls. IBM X-Force ID: 213725...

CVE-2021-39028

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site...