Security Bulletin: Rational Test Control Panel in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2017-5664)

Summary Apache Tomcat is vulnerable to a security issue affecting the Rational Test Control Panel component in IBM Rational Test Workbench and Rational Test Virtualization Server. Vulnerability Details CVE-ID: CVE-2017-5664 Description: Apache Tomcat could allow a remote attacker to bypass securi...

Security Bulletin: Security vulnerabilities in IBM Java Runtime affect IBM RLKS Administration and Reporting Tool Admin

Summary There are multiple vulnerabilities related to IBM® Runtime Environment Java™ Technology Edition which is used and shipped by different versions of IBM Rational License Key Server Administration and Reporting Tool Admin ART. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects Rational Insight

Summary There are vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by Rational Insight. The issues were disclosed as part of the IBM Java SDK updates in April 2017 and July 2017. Vulnerability Details CVEID: CVE-2017-3514 DESCRIPTION: An unspecified vulnerabili...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects Rational Reporting for Development Intelligence

Summary There are vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6 and 7 that are used by Rational Reporting for Development Intelligence RRDI. The issues were disclosed as part of the IBM Java SDK updates in April 2017 and July 2017. Vulnerability Details CVEID: CVE-2017-3514...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Performance Tester.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 and 1.7 used by Rational Performance Tester. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Service Tester.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 and 1.7 used by Rational Service Tester. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details If you run your own Java code using the IBM Java Runtime delivered...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Reporting for Development Intelligence (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

Summary Jazz Reporting Service is shipped as a component of Rational Reporting for Development Intelligence RRDI. Information about multiple security vulnerabilities affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-12617 DESCRIPTION...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-12617 DESCRIPTION: Apache Tomca...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Reporting Service shipped with Rational Insight (CVE-2017-12615, CVE-2017-12616, CVE-2017-12617)

Summary Jazz Reporting Service is shipped as a component of Rational Insight. Information about multiple security vulnerabilities affecting Jazz Reporting Service has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-12617 DESCRIPTION: Apache Tomcat could allow a remote...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6, Version 7 and Version 8 used by Rational Directory Server Tivoli and Rational Directory Administrator. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Install the recommended iFix...

Security Bulletin: Multiple Vulnerabilities in Oracle Outside In Technology affects IBM Rational DOORS Next Generation (CVE-2017-10141, CVE-2017-10196)

Summary IBM Rational DOORS Next Generation® is affected by multiple vulnerabilities in the Oracle Outside In Technology® that is used as a component. Vulnerability Details CVE-ID: CVE-2017-10141 Description: An unspecified vulnerability in Oracle Fusion Middleware related to the Outside In...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational DOORS Web Access

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 6, 7 and 8, which are used by IBM Rational DOORS Web Access. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecified...

Security Bulletin: Cross-site Scripting vulnerabilities affect Rational Engineering Lifecycle Manager

Summary Rational Engineering Lifecycle Manager is vulnerable to multiple cross-site scripting attacks with potential for credentials disclosure within a trusted session. Vulnerability Details CVEID: CVE-2017-1324 DESCRIPTION: IBM RELM is vulnerable to cross-site scripting. This vulnerability allo...

Security Bulletin: Multiple vulnerabilities in Apache Solr affect IBM Rational ClearQuest (CVE-2013-6407, CVE-2013-6408)

Summary The Apache Solr that is shipped with IBM Rational ClearQuest contains multiple security vulnerabilities. IBM Rational ClearQuest has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2013-6407 DESCRIPTION: Apache Solr could allow a remote authenticated attacker to obtain...

Security Bulletin: Security vulnerability has been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-7674)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about a security vulnerability affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-7674 DESCRIPTION: Apache Tomcat could...

Security Bulletin: Multiple security vulnerabilities have been identified in Jazz Team Server shipped with Jazz Reporting Service (CVE-2017-10115, CVE-2017-10116, CVE-2017-10053)

Summary Jazz Team Server is shipped as a component of Jazz Reporting Service JRS. Information about multiple security vulnerabilities affecting Jazz Team Server and Jazz-based products has been published in a security bulletin. Vulnerability Details CVEID: CVE-2017-10115 DESCRIPTION: An unspecifi...

Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server due to Cross-site Scripting. (CVE-2017-1380)

Summary WebSphere Application Server WAS is shipped as a component of Rational Asset Manager. In the WAS, cross-site scripting is observed in the Admin console which allows the user to embed arbitrary JavaScript code in the Web UI altering the intended functionality resulting in disclosure of...

Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server, where files with insecure permissions are created on executing the custom startup scripts. (CVE-2017-1382)

Summary WebSphere Application Server WAS is shipped as a component of Rational Asset Manager. When custom startup scripts are run, insecure files are created with default permission instead of customized permission. Such files are vulnerable to be accessed and exploited by a local attacker...

Security Bulletin: A security vulnerability has been identified in the WebSphere Application Server, where stale data containing sensitive information is cached and served. (CVE-2017-1381)

Summary WebSphere Application Server WAS is shipped as a component of Rational Asset Manager. When the system clock is adjusted, the WAS hosting RAM application could cache stale data containing sensitive information related to the RAM application. These stale data could be exploited by a local...

Security Bulletin: Multiple vulnerabilities in certain services of IBM Rational Software Architect Design Manager

Summary A number of services in Rational Software Architect Design Manager were not sanitizing user input properly thus potentially allowing cross-site scripting, json hijacking, and HTML injection attacks. Vulnerability Details CVEID: CVE-2015-7485 DESCRIPTION: IBM Jazz technology based products...