CVE-2015-7467

The CVE-2015-7467 issue affects IBM Jazz Reporting Service (JRS) via the Report Builder component. Affected versions are JRS 5.x prior to 5.0.2-Rational-CLM-ifix011 and 6.0 prior to 6.0.0-Rational-CLM-ifix005. The root cause is cross-site scripting (XSS) due to improper validation of user-supplie...

CVE-2015-7470

CVE-2015-7470 affects IBM Jazz Reporting Service (JRS) Report Builder in Rational Insight. Affected versions are JRS 5.0/5.0.1/5.0.2 and 6.0 prior to the indicated fixes. The vulnerability enables a man-in-the-middle attacker to obtain sensitive information (e.g., login information) via unspecifi...

CVE-2015-7469

CVE-2015-7469 affects IBM Jazz Reporting Service (JRS) Report Builder. The vulnerability arises from improper access control: users with JazzGuest roles can manipulate data that should be read-only. Affected versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0. IBM’s bulletin recomme...

CVE-2015-7468

CVE-2015-7468 concerns IBM Jazz Reporting Service (JRS) as part of Rational Insight. The vulnerability allows remote authenticated users to bypass restrictions on administrator tasks due to improper access control, affecting JRS 5.x up to 5.0.2-Rational-CLM-ifix011 and 6.0 up to 6.0.0-Rational-CL...

CVE-2015-7470

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as demonstrated by login information...

PT-2016-3791

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS versions 5.x before 5.0.2-Rational-CLM-ifix011 IBM Jazz Reporting Service JRS versions 6.0 before 6.0.0-Rational-CLM-ifix005 Description The issue allows remote authenticated users to bypass intended restrictions...

CVE-2015-7467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-7469: Undefined Security Weakness

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended read-only restrictions by leveraging a JazzGuest role...

CVE-2015-7468: Undefined Security Weakness

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to bypass intended restrictions on administrator tasks via unspecified vectors...

CVE-2015-7470: Exposure of Sensitive Information to an Unauthorized Actor

Report Builder in IBM Jazz Reporting Service JRS 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as demonstrated by login information...

PT-2016-3792

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS versions 5.x before 5.0.2-Rational-CLM-ifix011 IBM Jazz Reporting Service JRS versions 6.0 before 6.0.0-Rational-CLM-ifix005 Description The issue allows remote authenticated users to bypass intended read-only...

PT-2016-3790

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS versions 5.x before 5.0.2-Rational-CLM-ifix011 IBM Jazz Reporting Service JRS versions 6.0 before 6.0.0-Rational-CLM-ifix005 Description The issue is related to a cross-site scripting XSS vulnerability in the...

PT-2016-3793

Name of the Vulnerable Software and Affected Versions IBM Jazz Reporting Service JRS versions 5.x before 5.0.2-Rational-CLM-ifix011 IBM Jazz Reporting Service JRS versions 6.0 before 6.0.0-Rational-CLM-ifix005 Description The issue allows man-in-the-middle attackers to obtain sensitive informatio...

IBM Jazz Reporting Service Lifecycle Query Engine Cross-Site Request Forgery Vulnerability

IBM Jazz Reporting Service JRS is a suite of IBM USA applications for discovering cross-project reports that can be used in conjunction with IBM Rational CLM's Rational solution for managing all the lifecycles of a development project. CLM users can access JRS-provided reports from a dashboard th...

CVE-2015-7466

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

CVE-2015-7465

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

Design/Logic Flaw

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...

CVE-2015-7465

Cross-site request forgery CSRF vulnerability in Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2015-7466

Lifecycle Query Engine LQE in IBM Jazz Reporting Service JRS 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended query restrictions or modify the LDAP directory, via unspecified vectors...