CVE-2015-7465

CVE-2015-7465 concerns the Lifecycle Query Engine (LQE) within IBM Jazz Reporting Service (JRS). A CSRF vulnerability affects JRS 6.0 prior to 6.0.0-Rational-CLM-ifix005, enabling remote authenticated users to hijack the authentication of arbitrary users via requests that insert XSS sequences. Th...

CVE-2020-4419

CVE-2020-4419 affects IBM Jazz Reporting Service (JRS) Report Builder in versions 7.0, 6.0.6.1, and 6.0.6. The issue is a cross-site scripting vulnerability that can let an attacker embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. I...

CVE-2019-4495

IBM Jazz Reporting Service (JRS) versions 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6 and 6.0.6.1 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Th...

CVE-2019-4184

The CVE-2019-4184 entry affects IBM Jazz Reporting Service (JRS) versions 6.0–6.0.6.1, where a cross-site scripting (XSS) vulnerability in the Web UI could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. The NVD/NIST entry shows CVSS v3.0 base s...

CVE-2019-4497

CVE-2019-4497 affects IBM Jazz Reporting Service (JRS) versions 6.0–6.0.6.1. The vulnerability is a cross-site scripting flaw that lets attackers inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. The issue is documented across mul...

CVE-2024-25052

IBM Jazz Reporting Service 7.0.3 is vulnerable to information disclosure due to storing user credentials in plain text, readable by an administrator. The issue affects the IBM Jazz Reporting Service and, when Jazz Authentication Service is enabled, can expose the JSA Client Secret in clear text. ...

CVE-2017-1750

CVE-2017-1750 affects IBM Jazz Reporting Service (JRS): Cross-site scripting in JRS 5.0–5.0.2 and 6.0–6.0.5, enabling an attacker to inject arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session. The IBM security bulletins list affected products/versions and ...

CVE-2024-25051

IBM Jazz Reporting Service (versions 7.0.2–7.0.3) does not invalidate the user session on logout, allowing an authenticated privileged user to impersonate another user. Root cause: insufficient session expiration/invalidat ion after logout. Impact: potential privilege escalation and unauthorized ...

CVE-2016-0313

The CVE-2016-0313 entry concerns IBM Jazz Reporting Service (JRS) Report Builder and Data Collection Component (DCC). The vulnerability is a cross-site scripting (XSS) flaw triggered by a crafted URL, allowing remote authenticated users to execute script or HTML. Affected versions are JRS 5.x pri...

CVE-2018-1639

The CVE-2018-1639 issue affects Jazz Reporting Service’s Report Builder, impacting Jazz Reporting Service versions 5.0–5.0.2 and 6.0–6.0.6, where an authenticated user could obtain sensitive information beyond their privileges. The root cause is not detailed beyond privilege escalation of the Rep...

CVE-2019-4494

CVE-2019-4494 affects IBM Jazz Reporting Service (JRS) versions 6.0 through 6.0.6.1, where the web UI is vulnerable to cross-site scripting that can embed arbitrary JavaScript and potentially disclose credentials in a trusted session. The IBM Security Bulletin lists affected versions and provides...

CVE-2016-0317

The CVE-2016-0317 issue affects IBM Jazz Reporting Service’s Lifecycle Query Engine (LQE) shipped with Jazz Reporting Service 6.0 and 6.0.1 (prior to 6.0.1 iFix006). The vulnerability enables remote attackers to hijack click actions (clickjacking) via unspecified vectors. The IBM advisory groups ...

CVE-2017-1096

CVE-2017-1096 affects IBM Jazz Reporting Service (JRS) 5.0 and 6.0. It is a cross-site scripting vulnerability in the Web UI that could allow an authenticated user to embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Affected versions include JRS 5...

CVE-2016-5898

CVE-2016-5898 affects IBM Jazz Reporting Service (JRS) shipped with Rational Insight/RRDI. The vulnerability arises from not restricting JSON serialization, enabling a remote attacker to obtain sensitive information via a direct request. Affects JRS versions 5.0, 5.0.1, 5.0.2 and 6.0 (RRDI/Ration...

CVE-2016-6054

CVE-2016-6054 is an IBM Jazz-related cross-site scripting vulnerability affecting Jazz Foundation/Jazz Reporting Service. The vulnerability allows an attacker to inject arbitrary JavaScript into the Web UI, potentially leading to credential disclosure within a trusted session. Affected products i...

CVE-2019-4047

CVE-2019-4047 affects IBM Jazz Reporting Service (JRS) 6.0.6. The Lifecycle Query Engine vulnerability could allow an authenticated user to access execution log files as a guest user, thereby obtaining server execution information. Root cause details are not explicitly broken out in the provided ...

CVE-2015-7470

CVE-2015-7470 affects IBM Jazz Reporting Service (JRS) Report Builder in Rational Insight. Affected versions are JRS 5.0/5.0.1/5.0.2 and 6.0 prior to the indicated fixes. The vulnerability enables a man-in-the-middle attacker to obtain sensitive information (e.g., login information) via unspecifi...

CVE-2017-1340

IBM Jazz Reporting Service (JRS) 6.0.4 contains a vulnerability where an authenticated user could obtain information on another server that the report builder interacts with. The affected product is Jazz Reporting Service 6.0.4. Root cause details describe information disclosure via the Report Bu...

CVE-2016-5899

CVE-2016-5899: IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting in the Web UI. Affected Jazz Reporting Service versions: 5.0, 5.0.1, 5.0.2, 6.0, 6.0.1, and 6.0.2. The issue stems from JRS allowing arbitrary JavaScript execution via user input in the UI, potentially leading t...

CVE-2017-1490

The IBM Security Bulletin documents CVE-2017-1490 as a vulnerability in the Lifecycle Query Engine (LQE) shipped with Jazz Reporting Service, affecting Jazz Reporting Service versions 6.0–6.0.4 and capable of disclosing highly sensitive information. Remediation is patch-based: apply 6.0.2-Rationa...

CVE-2015-7468

CVE-2015-7468 concerns IBM Jazz Reporting Service (JRS) as part of Rational Insight. The vulnerability allows remote authenticated users to bypass restrictions on administrator tasks due to improper access control, affecting JRS 5.x up to 5.0.2-Rational-CLM-ifix011 and 6.0 up to 6.0.0-Rational-CL...

CVE-2016-5897

The CVE-2016-5897 issue pertains to IBM Jazz Reporting Service (JRS) and its Lifecycle Query Engine (LQE), where an HTML injection vulnerability could allow a remote attacker to cause malicious HTML to execute in a victim’s browser within the hosting site’s context. Affected products/versions are...

CVE-2018-2004

CVE-2018-2004 affects IBM Jazz Reporting Service (JRS) versions 6.0–6.0.6. It is a cross-site scripting vulnerability that allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The issue is documented with an IBM X-Force ID of...

CVE-2020-4933

IBM Jazz Reporting Service (JRS) is affected by CVE-2020-4933. Affected versions: JRS 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The vulnerability is a cross-site scripting flaw that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a t...

CVE-2016-0316

IBM Jazz Reporting Service’s Lifecycle Query Engine (LQE) is affected by CVE-2016-0316 (XSS). Affected products: Jazz Reporting Service 6.0 and 6.0.1; 6.0.1 is vulnerable to all listed issues, while 6.0.2 is affected by CVE-2016-0316. The vulnerability arises from improper validation of user-supp...

CVE-2016-6047

The CVE-2016-6047 entry concerns IBM Jazz Reporting Service (JRS). The connected IBM bulletins confirm this vulnerability is a cross-site scripting flaw in JRS (UI), capable of embedded arbitrary JavaScript and potentially leading to credential disclosure within a trusted session. Affected produc...

CVE-2015-7469

CVE-2015-7469 affects IBM Jazz Reporting Service (JRS) Report Builder. The vulnerability arises from improper access control: users with JazzGuest roles can manipulate data that should be read-only. Affected versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0. IBM’s bulletin recomme...

CVE-2016-0319

CVE-2016-0319 affects IBM Jazz Reporting Service (LQE) bundled with Jazz Reporting Service versions 6.0 and 6.0.1. The issue arises in the XML parser when processing XML data: an external entity declaration together with an entity reference enables a local authenticated administrator to read arbi...

CVE-2016-0314

The CVE-2016-0314 issue affects IBM Jazz Reporting Service (JRS) through the Report Builder/DCC component. Affects JRS 5.x before 5.0.2 IFIX016 and 6.x before 6.0.1 IFIX005; an authenticated remote attacker can perform clickjacking via unspecified vectors. IBM lists fixes: 5.0.x users should appl...

CVE-2016-9988

IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0 is affected by a cross-site scripting (XSS) vulnerability in the Web UI, potentially allowing an attacker to embed arbitrary JavaScript and cause credential disclosure within a trusted session. Affected products/versions are Jazz Reporting S...

CVE-2016-9989

The CVE-2016-9989 entry concerns IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0, which are vulnerable to cross-site scripting in the Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials in a trusted session. Sources describe this XSS for ...

CVE-2017-1157

IBM Jazz Reporting Service (JRS) 5.0/6.0 is affected by CVE-2017-1157, allowing an authenticated attacker to access report data restricted to authorized users. Affected products include Jazz Reporting Service integrated with Rational Insight/RRDI (5.0.x and 6.0.x lines). Remediation is available ...

CVE-2018-1918

IBM Jazz Reporting Service (JRS) is affected by CVE-2018-1918 in the Lifecycle Query Engine (LQE) shipped with JRS 6.0.3–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted sessio...

CVE-2015-7466

The CVE-2015-7466 issue affects IBM Jazz Reporting Service (JRS) Lifecycle Query Engine (LQE) in the JRS 6.0 line (before 6.0.0-Rational-CLM-ifix005). The vulnerability enables LDAP injection by remote authenticated users, allowing bypass of query restrictions or modification of the LDAP director...

CVE-2016-0350

IBM Jazz Reporting Service (JRS) Report Builder and Data Collection Component (DCC) is affected by CVE-2016-0350 (XSS) documented in JRS 5.x up to 5.0.2 ifix016 and 6.x up to 6.0.1 ifix005. A remote authenticated user can supply a crafted URL to inject arbitrary script/HTML in the victim’s browse...

CVE-2019-4651

IBM Jazz Reporting Service (JRS) 6.0.6.1 is vulnerable to SQL injection, allowing a remote attacker to view, add, modify, or delete data in the back-end database. The issue affects the Report Builder shipped with JRS. IBM’s security bulletin recommends applying the interim fix 6.0.6.1‑Rational-CL...

CVE-2016-9986

The CVE-2016-9986 entry affects IBM Jazz Foundation Reporting Service (JRS) 5.0 and 6.0. It is a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The vulnerability details and CVSS scores are documented in IBM/IBM X-Force reference...

CVE-2017-1370

CVE-2017-1370 affects IBM Jazz Reporting Service (JRS) versions 5.0–6.0 (as shipped with RRDI/Rational Insight). The vulnerability allows disclosure of sensitive information, including user credentials, via an error message on the Report Builder administrator configuration page. IBM security bull...

CVE-2018-1363

CVE-2018-1363 affects IBM Jazz Reporting Service (JRS) in Rational Insight RRDI and related bundles. The vulnerability is a cross-site scripting flaw in JRS Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Aff...

CVE-2016-0315

CVE-2016-0315 affects IBM Jazz Reporting Service (JRS) Report Builder/DCC: 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 retain session ID validity after logout, enabling a remote authenticated user to hijack a session on an unattended workstation. IBM security bulletins list Jazz Reporti...

CVE-2016-2888

The CVE-2016-2888 family affects IBM Jazz Reporting Service (JRS) and is caused by cross-site scripting via improper validation of user-supplied input in the Report Builder and Data Collection Component (DCC). Affects JRS 5.x before 5.0.2 (ifix016) and 6.x before 6.0.1 (ifix005). IBM security bul...

CVE-2016-9987

The CVE-2016-9987 entry describes a Cross‑Site Scripting vulnerability in IBM Jazz Foundation Reporting Service (JRS) present in JRS 5.0 and 6.0 (component of Rational Insight/RRDI). The vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and enab...

CVE-2020-4718

IBM Jazz Reporting Service (JRS) versions 6.0.6, 6.0.6.1, 7.0, and 7.0.1 are affected by CVE-2020-4718: a stored cross-site scripting vulnerability in the Web UI that could lead to credentials disclosure within a trusted session. The root cause is a vulnerability in the Report Builder shipped wit...

CVE-2021-20535

IBM Jazz Reporting Service is affected by CVE-2021-20535, impacting versions 6.0.6.1, 7.0, 7.0.1, and 7.0.2. The vulnerability is a server-side request forgery (SSRF) that could allow an authenticated attacker to issue unauthorized requests from the vulnerable system, potentially enabling network...

CVE-2016-2889

The CVE-2016-2889 entry concerns a CSRF vulnerability in IBM Jazz Reporting Service (JRS) affecting Report Builder and Data Collection Component (DCC). Affected products/versions include Jazz Reporting Service 5.0, 5.0.1, 5.0.2 and 6.0, as well as 6.0.1 before their respective fixes, with Jazz Re...

CVE-2016-6039

CVE-2016-6039 affects IBM Jazz Reporting Service (JRS) via cross-site scripting in the Web UI. According to IBM’s Security Bulletin for the Lifecycle Query Engine shipped with JRS, the vulnerability enables an attacker to embed arbitrary JavaScript in the UI, potentially leading to credential dis...

CVE-2020-4539

CVE-2020-4539 affects IBM Jazz Reporting Service (JRS) versions 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1. The issue is a cross-site scripting vulnerability that allows an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2020-4541

CVE-2020-4541 affects IBM Jazz Reporting Service (JRS) 7.0 and 7.0.1 with a cross-site scripting vulnerability in the Report Builder, allowing injected JavaScript in the Web UI and potential credential disclosure within a trusted session. The vulnerability details indicate the impact is limited t...

CVE-2020-4533

CVE-2020-4533 affects IBM Jazz Reporting Service (JRS) in versions 6.0.6, 6.0.6.1, and 7.0. The root cause is a cross-site scripting (XSS) vulnerability that allows embedded arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. Affected produc...

CVE-2015-7467

The CVE-2015-7467 issue affects IBM Jazz Reporting Service (JRS) via the Report Builder component. Affected versions are JRS 5.x prior to 5.0.2-Rational-CLM-ifix011 and 6.0 prior to 6.0.0-Rational-CLM-ifix005. The root cause is cross-site scripting (XSS) due to improper validation of user-supplie...