CVE-2015-0112

CVE-2015-0112 maps to an XML External Entity (XXE) issue in IBM Jazz Foundation/CLM stack (Jazz Team Server and multiple CLM-based products). Affected: CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG 4.x–5.0.2, RELM 1.0/4.0.3–5.0.2, Rhapsody DM 3.0–5.0, RSA DM 3.0–5.0, RTC 2.0–5.0.2, RQM 2.0–5.0.2. Impact: ...

IBM Rational Requirements Composer and Rational DOORS Next Generation Local Elevation of Privilege Vulnerability

IBM Rational Requirements Composer and Rational DOORS Next Generation RDNG are requirements management solutions from IBM USA. When WebSphere Application Server and LTPA single sign-on used in IBM Rational Requirements Composer and RDNG are used together, the program fails to terminate the...

CVE-2015-0121

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

Design/Logic Flaw

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

CVE-2015-0121

CVE-2015-0121 affects IBM Rational Requirements Composer (RRC) versions 3.0–3.0.1.6 and 4.0–4.0.7, and Rational DOORS Next Generation (RDNG) 4.0–4.0.7 and 5.0–5.0.2. When WebSphere Application Server uses LTPA single sign-on, the RM session is not terminated after LTPA token expiration, allowing ...

CVE-2015-0121

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

IBM Rational License Key Server Administration and Reporting Tool 8.1.4.x < 8.1.4.7 XSS

The remote host is running a version of IBM Rational License Key Server Administration and Reporting Tool RLKS that is 8.1.4.x prior to 8.1.4.7. It is, therefore, affected by a cross-site scripting vulnerability that allows an attacker to steal cookies and impersonate a valid user. %NASLMINLEVEL...

IBM Rational License Key Server Administration and Reporting Tool Information Disclosure Vulnerability

IBM Rational License Key Server Administration and Reporting Tool is a license administration and reporting tool. A security vulnerability in IBM Rational License Key Server Administration and Reporting Tool allows remote attackers to exploit the vulnerability to obtain cookie-based authenticatio...

CVE-2015-0113

The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...

Design/Logic Flaw

The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...

CVE-2015-0113

CVE-2015-0113 affects IBM Jazz-based products (CLM, RTC, RRC, RDNG, RELM, RQM, Rhapsody DM, RSA DM, and related components) where the Jazz Help System permits remote attackers to read JSP source code by sending a crafted request. Affected versions include CLM 4.0–5.0.2, RQM 4.0–4.0.7 and 5.0–5.0....

CVE-2015-0113

The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next...

Multiple IBM Rational Products Jazz Help System Information Disclosure Vulnerabilities

IBM Rational CLM, Rational Team Concert RTC, and Rational Engineering Lifecycle Manager are collaborative lifecycle management solutions; Rational Quality Manager RQM is a set of collaborative, Web-based quality management solutions; Rational Requirements Composer and Rational DOORS Next Generati...

IBM Rational ClearCase GSKit Encryption Issue Vulnerability

IBM Rational ClearCase is a suite of software configuration management solutions from IBM in the United States. The solution provides version control, workspace management, parallel development support and build auditing. A security vulnerability exists in the implementation of the MSCAPI/MSCNG...

CVE-2014-6221

The MSCAPI/MSCNG interface implementation in GSKit in IBM Rational ClearCase 7.1.2.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 does not properly generate random numbers, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via...

Information disclosure

The MSCAPI/MSCNG interface implementation in GSKit in IBM Rational ClearCase 7.1.2.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 does not properly generate random numbers, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via...

CVE-2014-6221

The MSCAPI/MSCNG interface implementation in GSKit in IBM Rational ClearCase 7.1.2.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 does not properly generate random numbers, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via...

CVE-2014-6221

Summary of CVE-2014-6221 (GSKit random data generation) : The GSKit MSCAPI/MSCNG interface does not generate cryptographically random data, enabling potential confidentiality/integrity compromise. Affected products and contexts include IBM GSKit in Rational ClearCase (various 7.1.2.x, 8.0.0.x, 8....

CVE-2014-8925

Cross-site request forgery CSRF vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences...

CVE-2014-6134

IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7, when Installation Manager before 1.8.2 is used, retains cleartext server passwords in process memory throughout the installation procedure, which might allow local users to obtain sensitive information by leveraging access to...