CVE-2017-1113

Affected software: IBM Rational Team Concert (RTC) and Rational CLM 4.0–6.0.3. Issue: cross-site scripting in the Web UI that allows embedding arbitrary JavaScript, potentially causing credentials disclosure within a trusted session. Affected components: RTC/CLM Web UI across 4.x–6.0.x line (RTC ...

CVE-2016-9733

IBM Team Concert RTC 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119762...

CVE-2017-1113

IBM Rational Team Concert RTC 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2016-9746

IBM Team Concert (RTC) is affected by cross-site scripting in its Web UI across Rational Collaborative Lifecycle Management 4.0–6.0.3 and RTC 4.0–6.0.3. The IBM Security Bulletin (D6F8507E.../IBM) details multiple XSS vulnerabilities (including CVE-2016-9746) allowing arbitrary JavaScript executi...

PT-2017-10299

Name of the Vulnerable Software and Affected Versions IBM Team Concert RTC versions 4.0 through 6.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2017-10306

Name of the Vulnerable Software and Affected Versions IBM Team Concert RTC versions 4.0 through 6.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2017-1113: Improper Neutralization of Input During Web Page Generation

IBM Rational Team Concert RTC 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2016-9733: Improper Neutralization of Input During Web Page Generation

IBM Team Concert RTC 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119762...

CVE-2016-9746: Improper Neutralization of Input During Web Page Generation

IBM Team Concert RTC 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 119821...

CVE-2017-1103

The CVE-2017-1103 issue affects IBM Team Concert (RTC) as part of Rational Collaborative Lifecycle Management and related RTC/QM components. It is caused by an XML External Entity (XXE) injection when processing XML data, enabling a remote attacker to potentially disclose sensitive information or...

CVE-2017-1103

IBM Team Concert RTC is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 120665...

CVE-2016-6037

IBM Rational Team Concert RTC is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains malicious HTML code, which when the project is viewed, would be executed in the victim's Web browser within the security context of the hosting...

CVE-2016-6037

The CVE-2016-6037 entry relates to an HTML injection vulnerability in IBM Rational Team Concert (RTC). A remote attacker with project administrator privileges can push a project containing malicious HTML that is executed in the victim’s browser within the hosting site’s security context. Affected...

PT-2017-11694

Name of the Vulnerable Software and Affected Versions IBM Team Concert RTC affected versions not specified Description The issue is caused by an XML External Entity Injection XXE error when processing XML data, which could allow a remote attacker to expose highly sensitive information or consume...

CVE-2017-1103: Improper Restriction of XML External Entity Reference

IBM Team Concert RTC is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 120665...

CVE-2016-6037: Improper Neutralization of Input During Web Page Generation

IBM Rational Team Concert RTC is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains malicious HTML code, which when the project is viewed, would be executed in the victim's Web browser within the security context of the hosting...

CVE-2016-0273

The CVE-2016-0273 entry applies to IBM Jazz-based CLM suite (and related products: RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM, etc.) with a cross-site scripting vulnerability exploitable by remote authenticated users via a specially crafted URL to inject arbitrary web script/HTML. The root cause i...

CVE-2016-0325

CVE-2016-0325 affects IBM Jazz-based CLM stack (Rational CLM/RQM/RRTC/RDNG/RELM/RSA DM and related) with multiple versions vulnerable prior to specific iFixes. The issue allows an authenticated remote attacker to execute arbitrary OS commands via a crafted HTTP request, impacting several CLM comp...

CVE-2016-0372

CVE-2016-0372 affects IBM Jazz-based CLM/RTC/RQM and related products. The vulnerability stems from not setting the secure flag on the session cookie in SSL mode, allowing a remote attacker to capture the cookie over HTTP. Impact is cookie exposure, not full remote code execution. Affected versio...

CVE-2016-9372

In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects...