CVE-2017-1592

This CVE (CVE-2017-1592) affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM). Affected versions are RCLM 5.0–5.0.2 and 6.0–6.0.5, and RQM 5.0–5.0.2 and 6.0–6.0.5. Root cause (per the sources) is cross-site scripting in the Web UI that permits embe...

CVE-2017-1651

CVE-2017-1651 affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5, with a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a ...

CVE-2017-1725

CVE-2017-1725 is an undisclosed information-disclosure vulnerability affecting IBM Jazz Team Server and multiple IBM Rational products based on Jazz technology (including CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM). The IBM security bulletin consolidates affected versions across CLM/RQM/RTC/R...

CVE-2017-1762

IBM Jazz Foundation in Rational CLM (versions 5.0–6.0) is affected by a cross-site scripting vulnerability in the Web UI. The issue allows an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products include CLM components—R...

CVE-2018-1826

The CVE-2018-1826 issue affects IBM Rational CLM versions 6.0–6.0.6.1 (including RQM/RTC/Rational DOORS Next Gen etc.). It is a Cross-Site Scripting vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript to alter functionality and potentially disclose credentials within a tr...

CVE-2019-4252

CVE-2019-4252 affects IBM Rational Collaborative Lifecycle Management and related Jazz-based products (CLM 6.0–6.0.6.1; including RTC/RQM/RRC and associated components). Root cause: directory traversal via crafted URL requests containing "/../" sequences, enabling a remote attacker to view arbitr...

CVE-2015-4946

CVE-2015-4946 affects IBM CLM/Jazz-based products (RCLM, RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM) and related Jazz Team Server components. The issue allows an authenticated user to bypass access restrictions and perform unauthorized actions due to a design/logic flaw in IBM Rational LifeCy...

CVE-2016-0219

CVE-2016-0219 is an XXE vulnerability in IBM Rational Team Concert. The IBM/CLM bulletin and NVD entries describe a denial-of-service risk when processing crafted XML data, affecting RTC 3.0 up to 6.0.1 (pre-iFix4). The issue manifests when XML with external entity references is parsed, enabling ...

CVE-2016-6061

The CVE-2016-6061 entry maps to IBM Jazz Foundation and is confirmed as a cross-site scripting vulnerability in the Jazz Web UI. The IBM Security Bulletin details multiple CLM-related products affected (Rational Collaborative Lifecycle Management, Rational Team Concert, Rational Quality Manager, ...

CVE-2016-9707

CVE-2016-9707: IBM Jazz Foundation is affected by an XML External Entity (XXE) vulnerability in XML processing, enabling potential exposure of sensitive data or memory exhaustion. The IBM security bulletin maps the affected products to the IBM Jazz CLM family (including Rational Collaborative Lif...

CVE-2017-1238

The CVE-2017-1238 entry concerns IBM Rational Quality Manager (RQM) versions 5.0.x and 6.0 up to 6.0.5, where the Web UI is vulnerable to cross-site scripting. The flaw allows embedding arbitrary JavaScript in the Web UI, potentially altering functionality and exposing credentials within a truste...

CVE-2017-1306

CVE-2017-1306 affects IBM Rational Quality Manager (RQM) and IBM Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5, where the Web UI is vulnerable to cross-site scripting (XSS) that could lead to credentials disclosure within a trusted session. The vulnerability ...

CVE-2021-29673

The CVE-2021-29673 entry describes a cross-site scripting (XSS) vulnerability in IBM Jazz Team Server products, allowing an attacker to inject arbitrary JavaScript into the Web UI and potentially disclose credentials within a trusted session. Affected IBM Jazz components include CLM, DOORS Next, ...

CVE-2017-1313

CVE-2017-1313 affects IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management, specifically versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that can allow an attacker to embed arbitrary JavaScript and potentially disclose ...

CVE-2017-1363

CVE-2017-1363 is an XSS vulnerability in IBM Team Concert (RTC) where arbitrary JavaScript could be injected into the Web UI, potentially leading to credentials disclosure within a trusted session. Connected sources confirm affected products include Rational Collaborative Lifecycle Management sui...

CVE-2017-1562

CVE-2017-1562 is a cross-site scripting vulnerability in IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM). According to connected IBM security disclosures, affected versions are RCLM 5.0–6.0.5 and RQM 5.0–5.0.2 and 6.0–6.0.5. The vulnerability allows embed...

CVE-2017-1602

Summary of CVE-2017-1602 (IBM RSA DM/CLM) : IBM Rational Collaborative Lifecycle Management (CLM) 5.0–6.0.5 is affected by an unauthenticated exposure vulnerability in RSA DM where an authenticated user can access settings they should not be able to via a specially crafted URL. The NVD entry assi...

CVE-2018-1694

IBM CVE-2018-1694 affects multiple Jazz-based products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM) and related 5.0–6.0.x releases. Root cause: failure to properly enable HTTP Strict Transport Security, enabling an attacker to obtain sensitive information via MITM. Impact: information disclos...

CVE-2018-1892

CVE-2018-1892 affects IBM Rational Collaborative Lifecycle Management and related CLM components (6.0 to 6.0.6.1). The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to inject arbitrary JavaScript, potentially leading to credentials disclosure within a tru...

CVE-2021-29786

CVE-2021-29786 describes an information-disclosure flaw in IBM Jazz Team Server products where user credentials are stored in plaintext and readable by an authenticated user. The vulnerability affects IBM Jazz Team Server family components (including CLM, ELM, DOORS Next, RTC, EWM, DOORS Next Gen...

CVE-2017-1293

CVE-2017-1293 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript, potentially leading to credentials discl...

CVE-2017-1488

CVE-2017-1488 is described in IBM and NVD records as an undisclosed information-disclosure vulnerability in Jazz common products. The IBM Security Bulletin (EB) ties this CVE to IBM Jazz-based products within Rational CLM/RTC/RQM/DOORS Next Gen/Engineering Lifecycle Manager/Rhapsody/Software Arch...

CVE-2017-1565

CVE-2017-1565 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) versions 5.0–5.0.2 and 6.0–6.0.5. The vulnerability is a cross-site scripting flaw in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to crede...

CVE-2018-1606

CVE-2018-1606 affects multiple IBM Jazz-based products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, etc.). An authenticated user could obtain sensitive information from error messages, enabling further attacks. Affected versions span CLM 5.0–6.0.6, RDNG 5.0–6.0.6, RELM 5.0–6.0.6, RTC 5.0–6.0....

CVE-2018-1688

Summary (CVE-2018-1688) IBM Jazz Foundation, used by CLM 5.0–6.0.6, is vulnerable to cross-site scripting in the Web UI, potentially allowing a trusted-session credential disclosure. The issue affects multiple CLM-related products built on IBM Jazz technology. Remediation is available via upgrade...

CVE-2018-1828

Summary: CVE-2018-1828 affects IBM Rational CLM 6.0–6.0.6.1, including components such as Rational Collaborative Lifecycle Management, Rational Quality Manager, Rational Team Concert, and related IBM Jazz-enabled tools. Root cause / impact: The vulnerability is a cross-site scripting (XSS) flaw a...

CVE-2018-1893

CVE-2018-1893 affects IBM Rational CLM family (CLM 6.0–6.0.6.1), including Rational Quality Manager, DOORS Next, Team Concert, Rhapsody products, and related components. The issue is a cross-site scripting vulnerability in the Web UI that could let an attacker inject arbitrary JavaScript, potenti...

CVE-2015-0113

CVE-2015-0113 affects IBM Jazz-based products (CLM, RTC, RRC, RDNG, RELM, RQM, Rhapsody DM, RSA DM, and related components) where the Jazz Help System permits remote attackers to read JSP source code by sending a crafted request. Affected versions include CLM 4.0–5.0.2, RQM 4.0–4.0.7 and 5.0–5.0....

CVE-2016-2947

CVE-2016-2947 describes an information disclosure vulnerability in IBM Jazz Foundation products (CLM, RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM) and related RFPs. The issue affects multiple versions across CLM 4.0–6.0.2, RQM 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RTC 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RDNG 4...

CVE-2016-6028

CVE-2016-6028 affects IBM Jazz technology-based products (CLM, RTC, RDNG, RELM, RQM, RSA DM, Rhapsody DM) where an attacker could view work item titles they should not have access to. The IBM Security Bulletin (and related IBM/NVD entries) confirm the root cause is insufficient access control aro...

CVE-2017-1281

CVE-2017-1281 affects IBM Rational Quality Manager and Rational Collaborative Lifecycle Management versions 5.0–5.0.2 and 6.0–6.0.5. The issue is a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a t...

CVE-2017-1294

CVE-2017-1294 is a cross-site scripting vulnerability in IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (RCLM) affecting 5.0–5.0.2 and 6.0–6.0.5. The Web UI can embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Reme...

CVE-2017-1653

CVE-2017-1653 describes a cross-site scripting vulnerability in IBM Jazz Foundation used by IBM Rational CLM/Jazz technologies. The IBM bulletin details that IBM Jazz Foundation is vulnerable in CLM stack versions 6.0 through 6.0.4, including CLM components such as Rational Team Concert, Rational...

CVE-2020-4974

CVE-2020-4974 affects IBM Jazz Foundation and multiple IBM Engineering products (EWM, DOORS Next, RTC, RDNG, RQM, ELN/ENI/RELM/ELM, etc.). The vulnerability is Server-Side Request Forgery (SSRF) that an authenticated attacker could exploit to cause the system to send unauthorized requests, enabli...

CVE-2017-1169

CVE-2017-1169 affects IBM Rational DOORS Next Generation (DNG/RRC). The issue is a cross-site scripting vulnerability in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin enumerates a...

CVE-2017-1568

Summary: CVE-2017-1568 maps to an XSS vulnerability in IBM Rational Quality Manager (RQM) and Rational CLM, affecting 5.0–5.0.2 and 6.0–6.0.5. The issue arises in the Web UI, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected...

CVE-2017-1652

CVE-2017-1652 affects IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management, with cross-site scripting in the Web UI in RQM/CLM versions 5.0–5.0.2 and 6.0–6.0.5. The root cause is improper handling of user-supplied input in the web interface, enabling an attacker to emb...

CVE-2017-1655

Consolidated for CVE-2017-1655: IBM Jazz Foundation (IBM Rational CLM 5.0/6.0) contains a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. The IBM Security Bulletin lists affecte...

CVE-2018-1492

CVE-2018-1492 — normal mode IBM Jazz Foundation/Jazz Team Server family is affected. The issue allows a user with physical access to log in as another user because the server does not properly log out from the previous session. Affected products/versions include Rational CLM, RDNG, RELM, RTC, RQM...

CVE-2020-5004

CVE-2020-5004 is a cross-site scripting vulnerability in IBM Jazz Foundation Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue affects IBM Jazz Foundation–based products (as listed in IBM advisories) and is refle...

CVE-2016-0331

This CVE affects IBM Rational Team Concert (RTC) and Rational Collaborative Lifecycle Management (CLM) versions 6.0.1–6.0.2 prior to 6.0.2 iFix2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user-supplied input, allowing remote authenticated users to inj...

CVE-2016-6030

Concrete details found: CVE-2016-6030 affects IBM Jazz Foundation (Jazz/CLM family). The vulnerability is a cross-site scripting flaw in the Web UI that can let an attacker embed arbitrary JavaScript code, potentially leading to credentials disclosure within a trusted session. Affected products/v...

CVE-2016-6032

CVE-2016-6032 affects IBM Rational Team Concert in the Rational CLM stack (RTC 4.0–6.0.x). The issue is a cross-site scripting vulnerability in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The IBM securit...

CVE-2016-9701

CVE-2016-9701 affects IBM Team Concert / Rational Team Concert (RTC) across multiple releases (RTC 4.0–6.0.x; Rational CLM 4.0–6.0.3). The vulnerability is a cross‑site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potentially altering functionality and leading to...

CVE-2017-1280

CVE-2017-1280 affects IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (CLM) 5.0–5.0.2 and 6.0–6.0.5. The root cause is cross-site scripting in the Web UI that allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted s...

CVE-2017-1621

CVE-2017-1621 affects IBM Rational Quality Manager and Rational Collaborative Lifecycle Management (RCLM) releases 5.0–5.0.2 and 6.0–6.0.5. The root cause is a cross-site scripting flaw in the Web UI that can allow embedding arbitrary JavaScript, potentially leading to credentials disclosure with...

CVE-2018-1423

CVE-2018-1423 affects IBM Jazz Foundation products (e.g., IBM Jazz Team Server and Rhapsody Design Manager). It permits an authenticated attacker to disclose sensitive information, enabling further attacks. IBM remediation for affected 6.x releases includes upgrading to 6.0.5 iFix6 or later (and ...

CVE-2018-1762

The CVE-2018-1762 issue affects IBM Rational CLM and related Jazz-based products (CLM 5.0–5.0.2 and 6.0–6.0.6; QA Manager, Team Concert, DOORS NG, RQM, Rhapsody DM, RSA DM, and others) where a cross-site scripting vulnerability in the Web UI allows an attacker to inject arbitrary JavaScript, pote...

CVE-2014-6129

CVE-2014-6129 affects IBM Jazz Team Server (JTS)–based products (CLM, RRC, RDNG, RELM, RTC, RQM, RSA DM, Rhapsody DM, etc.). Described as an authenticated issue where a user with knowledge of JTS can delete another user’s dashboard via unspecified vectors. Affected versions include Rational CLM 3...

CVE-2015-7471

CVE-2015-7471 is an XSS vulnerability affecting IBM Jazz-based CLM products (and associated RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM, and Jazz Team Server components) across multiple versions (CLM 3.0.1–6.0.1, RQM 3.0.x–3.0.1.6, RTC 3.0.x–6.0.x, RRC 3.0.x–4.0.x, RDNG 4.0.x–6.0.x, RELM 4.0.3...