CVE-2017-1363

CVE-2017-1363 is an XSS vulnerability in IBM Team Concert (RTC) where arbitrary JavaScript could be injected into the Web UI, potentially leading to credentials disclosure within a trusted session. Connected sources confirm affected products include Rational Collaborative Lifecycle Management sui...

CVE-2017-1524

CVE-2017-1524 affects IBM Jazz Foundation (part of IBM Rational CLM 5.0/6.0). An authenticated user could obtain sensitive information from a specially crafted HTTP request, potentially aiding future attacks. The issue is documented with a CVSS v3 base score of 4.3 (Network, Low UI, Privileges Lo...

CVE-2017-1592

This CVE (CVE-2017-1592) affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM). Affected versions are RCLM 5.0–5.0.2 and 6.0–6.0.5, and RQM 5.0–5.0.2 and 6.0–6.0.5. Root cause (per the sources) is cross-site scripting in the Web UI that permits embe...

CVE-2018-1734

CVE-2018-1734 affects IBM Rational Collaborative Lifecycle Management (CLM) versions 6.0–6.0.6.1. The root cause is disclosure of sensitive information in error messages, which could enable a malicious user to orchestrate further attacks. Affected products include CLM components such as Rational ...

CVE-2017-1313

CVE-2017-1313 affects IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management, specifically versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript and potentially disclose ...

CVE-2017-1629

CVE-2017-1629 involves IBM Jazz Foundation within IBM Rational CLM 5.0–6.0, where a cross-site scripting flaw in the Web UI could let an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. The IBM bulletin and related advisories group CLM compo...

CVE-2019-4252

CVE-2019-4252 affects IBM Rational Collaborative Lifecycle Management and related Jazz-based products (CLM 6.0–6.0.6.1; including RTC/RQM/RRC and associated components). Root cause: directory traversal via crafted URL requests containing "/../" sequences, enabling a remote attacker to view arbitr...

CVE-2021-29673

The CVE-2021-29673 entry describes a cross-site scripting (XSS) vulnerability in IBM Jazz Team Server products, allowing an attacker to inject arbitrary JavaScript into the Web UI and potentially disclose credentials within a trusted session. Affected IBM Jazz components include CLM, DOORS Next, ...

CVE-2015-0113

CVE-2015-0113 affects IBM Jazz-based products (CLM, RTC, RRC, RDNG, RELM, RQM, Rhapsody DM, RSA DM, and related components) where the Jazz Help System permits remote attackers to read JSP source code by sending a crafted request. Affected versions include CLM 4.0–5.0.2, RQM 4.0–4.0.7 and 5.0–5.0....

CVE-2016-0219

CVE-2016-0219 is an XXE vulnerability in IBM Rational Team Concert. The IBM/CLM bulletin and NVD entries describe a denial-of-service risk when processing crafted XML data, affecting RTC 3.0 up to 6.0.1 (pre-iFix4). The issue manifests when XML with external entity references is parsed, enabling ...

CVE-2016-6028

CVE-2016-6028 affects IBM Jazz technology-based products (CLM, RTC, RDNG, RELM, RQM, RSA DM, Rhapsody DM) where an attacker could view work item titles they should not have access to. The IBM Security Bulletin (and related IBM/NVD entries) confirm the root cause is insufficient access control aro...

CVE-2017-1239

The CVE-2017-1239 issue affects IBM Rational Quality Manager (RQM) components in Rational CLM: 5.0.x and 6.0.x up to 6.0.5. The vulnerability allows sensitive information exposure via HTTP 500 Internal Server Error responses, as described in IBM’s Security Bulletin for RQM. Root cause details are...

CVE-2017-1488

CVE-2017-1488 is described in IBM and NVD records as an undisclosed information-disclosure vulnerability in Jazz common products. The IBM Security Bulletin (EB) ties this CVE to IBM Jazz-based products within Rational CLM/RTC/RQM/DOORS Next Gen/Engineering Lifecycle Manager/Rhapsody/Software Arch...

CVE-2017-1762

IBM Jazz Foundation in Rational CLM (versions 5.0–6.0) is affected by a cross-site scripting vulnerability in the Web UI. The issue allows an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products include CLM components—R...

CVE-2018-1828

Summary: CVE-2018-1828 affects IBM Rational CLM 6.0–6.0.6.1, including components such as Rational Collaborative Lifecycle Management, Rational Quality Manager, Rational Team Concert, and related IBM Jazz-enabled tools. Root cause / impact: The vulnerability is a cross-site scripting (XSS) flaw a...

CVE-2016-2947

CVE-2016-2947 describes an information disclosure vulnerability in IBM Jazz Foundation products (CLM, RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM) and related RFPs. The issue affects multiple versions across CLM 4.0–6.0.2, RQM 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RTC 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RDNG 4...

CVE-2016-6032

CVE-2016-6032 affects IBM Rational Team Concert in the Rational CLM stack (RTC 4.0–6.0.x). The issue is a cross-site scripting vulnerability in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM securit...

CVE-2017-1561

CVE-2017-1561 is a cross‑site scripting vulnerability affecting IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management. Technical details in connected docs show the issue exists in RQM/RCLM versions 5.0–5.0.2 and 6.0–6.0.5, enabling an attacker to inject JavaScript in th...

CVE-2017-1562

CVE-2017-1562 is a cross-site scripting vulnerability in IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM). According to connected IBM security disclosures, affected versions are RCLM 5.0–6.0.5 and RQM 5.0–5.0.2 and 6.0–6.0.5. The vulnerability allows embed...

CVE-2016-6040

The CVE-2016-6040 issue affects IBM Jazz Foundation within IBM Jazz-based CLM/Rational products. An authenticated user could take over a previously logged-in user because session expiration is not enforced. Affected products include Rational CLM 4.0–6.0.2, Rational Team Concert, Rational Quality ...

CVE-2016-9701

CVE-2016-9701 affects IBM Team Concert / Rational Team Concert (RTC) across multiple releases (RTC 4.0–6.0.x; Rational CLM 4.0–6.0.3). The vulnerability is a cross‑site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potentially altering functionality and leading to...

CVE-2017-1169

CVE-2017-1169 affects IBM Rational DOORS Next Generation (DNG/RRC). The issue is a cross-site scripting vulnerability in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin enumerates a...

CVE-2017-1294

CVE-2017-1294 is a cross-site scripting vulnerability in IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) affecting 5.0–5.0.2 and 6.0–6.0.5. The Web UI can embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Reme...

CVE-2017-1565

CVE-2017-1565 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5. The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to crede...

CVE-2017-1568

Summary: CVE-2017-1568 maps to an XSS vulnerability in IBM Rational Quality Manager (RQM) and Rational CLM, affecting 5.0–5.0.2 and 6.0–6.0.5. The issue arises in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected...

CVE-2017-1652

CVE-2017-1652 affects IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management, with cross-site scripting in the Web UI in RQM/CLM versions 5.0–5.0.2 and 6.0–6.0.5. The root cause is improper handling of user-supplied input in the web interface, enabling an attacker to emb...

CVE-2017-1653

CVE-2017-1653 describes a cross-site scripting vulnerability in IBM Jazz Foundation used by IBM Rational CLM/Jazz technologies. The IBM bulletin details that IBM Jazz Foundation is vulnerable in CLM stack versions 6.0 through 6.0.4, including CLM components such as Rational Team Concert, Rational...

CVE-2018-1688

Summary (CVE-2018-1688) IBM Jazz Foundation, used by CLM 5.0–6.0.6, is vulnerable to cross-site scripting in the Web UI, potentially allowing a trusted-session credential disclosure. The issue affects multiple CLM-related products built on IBM Jazz technology. Remediation is available via upgrade...

CVE-2018-1762

The CVE-2018-1762 issue affects IBM Rational CLM and related Jazz-based products (CLM 5.0–5.0.2 and 6.0–6.0.6; QA Manager, Team Concert, DOORS NG, RQM, Rhapsody DM, RSA DM, and others) where a cross-site scripting vulnerability in the Web UI allows an attacker to inject arbitrary JavaScript, pote...

CVE-2018-1893

CVE-2018-1893 affects IBM Rational CLM family (CLM 6.0–6.0.6.1), including Rational Quality Manager, DOORS Next, Team Concert, Rhapsody products, and related components. The issue is a cross-site scripting vulnerability in the Web UI that could let an attacker inject arbitrary JavaScript, potenti...

CVE-2021-29786

CVE-2021-29786 describes an information-disclosure flaw in IBM Jazz Team Server products where user credentials are stored in plaintext and readable by an authenticated user. The vulnerability affects IBM Jazz Team Server family components (including CLM, ELM, DOORS Next, RTC, EWM, DOORS Next Gen...

CVE-2016-9747

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0–6.0.2 are vulnerable to cross-site scripting in the Web UI, enabling arbitrary JavaScript execution and potential credentials disclosure within a trusted session. The IBM Security Bulletin confirms the affected products and versions, ...

CVE-2017-1238

The CVE-2017-1238 entry concerns IBM Rational Quality Manager (RQM) versions 5.0.x and 6.0 up to 6.0.5, where the Web UI is vulnerable to cross-site scripting. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and exposing credentials within a truste...

CVE-2017-1281

CVE-2017-1281 affects IBM Rational Quality Manager and Rational Collaborative Lifecycle Management versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a t...

CVE-2017-1293

CVE-2017-1293 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript, potentially leading to credentials discl...

CVE-2017-1306

CVE-2017-1306 affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5, where the Web UI is vulnerable to cross-site scripting (XSS) that could lead to credentials disclosure within a trusted session. The vulnerability ...

CVE-2017-1602

Summary of CVE-2017-1602 (IBM RSA DM/CLM) : IBM Rational Collaborative Lifecycle Management (CLM) 5.0–6.0.5 is affected by an unauthenticated exposure vulnerability in RSA DM where an authenticated user can access settings they should not be able to via a specially crafted URL. The NVD entry assi...

CVE-2017-1651

CVE-2017-1651 affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5, with a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a ...

CVE-2017-1734

CVE-2017-1734 affects IBM Jazz Team Server and related IBM Rational products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM). The vulnerability involves the cache storing potentially sensitive information that authenticated users could read. Affected releases cover CLM/RQM/RTC/RDNG/RELM/RSA DM u...

CVE-2018-1694

IBM CVE-2018-1694 affects multiple Jazz-based products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM) and related 5.0–6.0.x releases. Root cause: failure to properly enable HTTP Strict Transport Security, enabling an attacker to obtain sensitive information via MITM. Impact: information disclos...

CVE-2018-1892

CVE-2018-1892 affects IBM Rational Collaborative Lifecycle Management and related CLM components (6.0 to 6.0.6.1). The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a tru...

CVE-2020-5004

CVE-2020-5004 is a cross-site scripting vulnerability in IBM Jazz Foundation Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue affects IBM Jazz Foundation–based products (as listed in IBM advisories) and is refle...

CVE-2015-7471

CVE-2015-7471 is an XSS vulnerability affecting IBM Jazz-based CLM products (and associated RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM, and Jazz Team Server components) across multiple versions (CLM 3.0.1–6.0.1, RQM 3.0.x–3.0.1.6, RTC 3.0.x–6.0.x, RRC 3.0.x–4.0.x, RDNG 4.0.x–6.0.x, RELM 4.0.3...

CVE-2016-0331

This CVE affects IBM Rational Team Concert (RTC) and Rational Collaborative Lifecycle Management (CLM) versions 6.0.1–6.0.2 prior to 6.0.2 iFix2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user-supplied input, allowing remote authenticated users to inj...

CVE-2017-1280

CVE-2017-1280 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (CLM) 5.0–5.0.2 and 6.0–6.0.5. The root cause is cross-site scripting in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted s...

CVE-2017-1621

CVE-2017-1621 affects IBM Rational Quality Manager and Rational Collaborative Lifecycle Management (RCLM) releases 5.0–5.0.2 and 6.0–6.0.5. The root cause is a cross-site scripting flaw in the Web UI that can allow embedding arbitrary JavaScript, potentially leading to credentials disclosure with...

CVE-2018-1492

CVE-2018-1492 — normal mode IBM Jazz Foundation/Jazz Team Server family is affected. The issue allows a user with physical access to log in as another user because the server does not properly log out from the previous session. Affected products/versions include Rational CLM, RDNG, RELM, RTC, RQM...

CVE-2016-6030

Concrete details found: CVE-2016-6030 affects IBM Jazz Foundation (Jazz/CLM family). The vulnerability is a cross-site scripting flaw in the Web UI that can let an attacker embed arbitrary JavaScript code, potentially leading to credentials disclosure within a trusted session. Affected products/v...

CVE-2017-1248

CVE-2017-1248 affects IBM Rational Quality Manager (RQM) 5.0.x and 6.0–6.0.5, with an HTML injection flaw that could execute code in a user’s browser within the hosting site’s context. The IBM bulletin A27047ED73E7AE4D822B59EB4E55C43E9EF28F36E8CF4AFFCD62BFF92FCC5593 lists this CVE among multiple ...

CVE-2017-1690

IBM Rational Quality Manager and Rational Collaborative Lifecycle Management are affected by a cross-site scripting (XSS) vulnerability in the Web UI for versions 5.0–5.0.2 and 6.0–6.0.5. The issue can allow embedding arbitrary JavaScript, potentially leading to credential disclosure within a tru...