Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Rational ClearQuest (CVE-2018-1719)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Rational ClearQuest. Information about a security vulnerability affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 & 8 and IBM® Runtime Environment Java™ Version 7 & 8 used by Rational Performance Tester. Rational Performance Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTIO...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 & 8 and IBM® Runtime Environment Java™ Version 7 & 8 used by Rational Service Tester. Rational Service Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1656 DESCRIPTION: The I...

IBM Rational Requirements Composer and Rational DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability in IBM Rational...

CVE-2018-1610

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

Cross site scripting

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2018-1610

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2018-1610

IBM Rational DOORS Next Generation (RDNG) versions affected: 5.0–5.0.2 and 6.0–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause details...

IBM Rational Engineering Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2018-23902)

IBM Rational Engineering Lifecycle Manager is a suite of engineering lifecycle management software from IBM in the United States. A cross-site scripting vulnerability exists in IBM Rational Engineering Lifecycle Manager. A remote attacker can exploit this vulnerability to inject arbitrary...

PT-2018-13411

Name of the Vulnerable Software and Affected Versions IBM Rational DOORS Next Generation versions 5.0 through 5.0.2 IBM Rational DOORS Next Generation versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionalit...

CVE-2018-1610: Improper Neutralization of Input During Web Page Generation

IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...

CVE-2018-1607

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID:...

CVE-2018-1659

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2018-1659

IBM Rational Engineering Lifecycle Manager is affected by a cross-site scripting vulnerability affecting version ranges 5.0–5.0.2 and 6.0–6.0.6. The flaw enables arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM bulletin (CVE-2018-...

CVE-2018-1560

IBM Rational Engineering Lifecycle Manager is affected by CVE-2018-1560: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 5.0–5.02 and 6.0–6.0.6. Remediation per IBM bulletin: upgrade to 6.0.6 IFIX02 or late...

CVE-2018-1539

CVE-2018-1539 affects IBM Rational Engineering Lifecycle Manager versions 5.0–5.02 and 6.0–6.0.6. The issue allows remote attackers to bypass authentication via a direct request or forced browsing to a URL outside the intended page. Public details in connected IBM advisories describe this as an a...

CVE-2018-1607

CVE-2018-1607 affects IBM Rational Engineering Lifecycle Manager 5.0–5.02 and 6.0–6.0.6. It enables a XML External Entity (XXE) attack when parsing XML, potentially exposing sensitive information or consuming memory resources. The security bulletin lists multiple affected versions and states reme...

CVE-2018-1560

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

Authentication flaw

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561...

Cross site scripting

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...