CVE-2016-2947

CVE-2016-2947 describes an information disclosure vulnerability in IBM Jazz Foundation products (CLM, RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM) and related RFPs. The issue affects multiple versions across CLM 4.0–6.0.2, RQM 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RTC 4.0–4.0.7/5.0–5.0.2/6.0–6.0.2, RDNG 4...

CVE-2017-1335

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–6.0.4 are affected by a Cross‑Site Scripting (XSS) vulnerability in the Web UI that can inject arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue affects RELM’s UI components and is documented ...

CVE-2017-1653

CVE-2017-1653 describes a cross-site scripting vulnerability in IBM Jazz Foundation used by IBM Rational CLM/Jazz technologies. The IBM bulletin details that IBM Jazz Foundation is vulnerable in CLM stack versions 6.0 through 6.0.4, including CLM components such as Rational Team Concert, Rational...

CVE-2017-1734

CVE-2017-1734 affects IBM Jazz Team Server and related IBM Rational products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM). The vulnerability involves the cache storing potentially sensitive information that authenticated users could read. Affected releases cover CLM/RQM/RTC/RDNG/RELM/RSA DM u...

CVE-2018-1492

CVE-2018-1492 — normal mode IBM Jazz Foundation/Jazz Team Server family is affected. The issue allows a user with physical access to log in as another user because the server does not properly log out from the previous session. Affected products/versions include Rational CLM, RDNG, RELM, RTC, RQM...

CVE-2018-1694

IBM CVE-2018-1694 affects multiple Jazz-based products (CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM) and related 5.0–6.0.x releases. Root cause: failure to properly enable HTTP Strict Transport Security, enabling an attacker to obtain sensitive information via MITM. Impact: information disclos...

CVE-2018-1910

IBM Rational Engineering Lifecycle Manager (REL M) versions 5.0 through 6.0.6 are affected by a cross-site scripting (XSS) vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Root cause: improper hand...

CVE-2020-4524

CVE-2020-4524 concerns an IBM Jazz Foundation cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. The issue affects IBM Jazz Foundation family products (and related IBM ELM/RTC/RM components)...

CVE-2020-4855

The CVE-2020-4855 issue affects IBM Jazz Foundation products and is a cross-site scripting vulnerability in the Web UI that could enable an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. Affected components include IBM Jazz Team Server family (E...

CVE-2020-5004

CVE-2020-5004 is a cross-site scripting vulnerability in IBM Jazz Foundation Web UI that could allow an attacker to embed arbitrary JavaScript and potentially disclose credentials in a trusted session. The issue affects IBM Jazz Foundation–based products (as listed in IBM advisories) and is refle...

CVE-2021-29786

CVE-2021-29786 describes an information-disclosure flaw in IBM Jazz Team Server products where user credentials are stored in plaintext and readable by an authenticated user. The vulnerability affects IBM Jazz Team Server family components (including CLM, ELM, DOORS Next, RTC, EWM, DOORS Next Gen...

CVE-2015-7471

CVE-2015-7471 is an XSS vulnerability affecting IBM Jazz-based CLM products (and associated RQM, RTC, RRC, RDNG, RELM, Rhapsody DM, RSA DM, and Jazz Team Server components) across multiple versions (CLM 3.0.1–6.0.1, RQM 3.0.x–3.0.1.6, RTC 3.0.x–6.0.x, RRC 3.0.x–4.0.x, RDNG 4.0.x–6.0.x, RELM 4.0.3...

CVE-2017-1334

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.4 are vulnerable to cross-site scripting in the Web UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. The root cause is a cross-site s...

CVE-2017-1429

CVE-2017-1429 affects IBM Rational Engineering Lifecycle Manager (RELM) versions 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.4. The vulnerability is a cross-site scripting flaw in the Web UI that can lead to credentials disclosure within a trusted session. Root cause is not detailed beyond the XSS descri...

CVE-2020-4974

CVE-2020-4974 affects IBM Jazz Foundation and multiple IBM Engineering products (EWM, DOORS Next, RTC, RDNG, RQM, ELN/ENI/RELM/ELM, etc.). The vulnerability is Server-Side Request Forgery (SSRF) that an authenticated attacker could exploit to cause the system to send unauthorized requests, enabli...

CVE-2016-9747

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0–6.0.2 are vulnerable to cross-site scripting in the Web UI, enabling arbitrary JavaScript execution and potential credentials disclosure within a trusted session. The IBM Security Bulletin confirms the affected products and versions, ...

CVE-2017-1364

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.4 are affected by a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Root cause is a reflected/stored XSS in the RELM web interface (as ...

CVE-2017-1655

Consolidated for CVE-2017-1655: IBM Jazz Foundation (IBM Rational CLM 5.0/6.0) contains a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject arbitrary JavaScript and potentially disclose credentials in a trusted session. The IBM Security Bulletin lists affecte...

CVE-2016-2864

Summary: CVE-2016-2864 is a cross-site scripting (XSS) vulnerability affecting multiple IBM Jazz-based products (CLM, RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM) with affected versions ranging from CLM 3.0.1.6 to 6.0.x. The root cause is improper validation of user-supplied input, allowing remote ...

CVE-2017-1369

IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–6.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The issue stems from embedded arbitrary JavaScript in the UI, as described across multi...

CVE-2018-1423

CVE-2018-1423 affects IBM Jazz Foundation products (e.g., IBM Jazz Team Server and Rhapsody Design Manager). It permits an authenticated attacker to disclose sensitive information, enabling further attacks. IBM remediation for affected 6.x releases includes upgrading to 6.0.5 iFix6 or later (and ...

CVE-2018-1916

CVE-2018-1916 affects IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0–6.0.6). The vulnerability is a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially enabling credential disclosure within a trusted session. The IBM bulletin lists ...

CVE-2020-4964

CVE-2020-4964 affects IBM Jazz Team Server and related IBM Engineering Lifecycle Management components. The vulnerability is described as an undisclosed issue allowing an authenticated user to display a customized message within the application to phish other users. Public details from IBM’s bull...

CVE-2017-1324

Summary: IBM RELM (Rational Engineering Lifecycle Manager) versions 4.0.3–4.0.7, 5.0–5.0.2, and 6.0–6.0.4 are affected by a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure in a trusted session. Root cause: Web UI input handling allows injection of ar...

CVE-2020-4546

CVE-2020-4546 is an XSS vulnerability in IBM Jazz Team Server Web UI affecting multiple Jazz-based applications (ELM, DOORS Next, ENI, EWM, RQM, CLM, etc.). The root cause is arbitrary JavaScript/HTML injection in the Web UI, enabling credential exposure within a trusted session. The IBM security...

CVE-2020-4547

IBM Jazz Foundation products are affected by CVE-2020-4547, a remote, click-hijacking vulnerability where誘 users are tricked into visiting a malicious site, enabling an attacker to hijack the victim’s clicking actions and potentially launch further attacks. Affected stack spans IBM Jazz Team Serv...

CVE-2015-1971

CVE-2015-1971 affects IBM Jazz Team Server-based products across CLM, RRC, RDNG, RELM, RTC, RQM, Rhapsody DM, and RSA DM. An unspecified denial-of-service vulnerability exists in Jazz Team Server components used by these products, with affected ranges spanning CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG...

CVE-2018-1659

IBM Rational Engineering Lifecycle Manager is affected by a cross-site scripting vulnerability affecting version ranges 5.0–5.0.2 and 6.0–6.0.6. The flaw enables arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM bulletin (CVE-2018-...

CVE-2015-7484

IBM Rational Engineering Lifecycle Manager is affected by CVE-2015-7484. The issue allows an authenticated user with project access to obtain sensitive information by sending a crafted URL to the Lifecycle Query Engine. Root cause is an information-disclosure path via LQE; impact is partial confi...

CVE-2015-7449

CVE-2015-7449 affects IBM Jazz Foundation-based products (CLM, RRC, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, and related Jazz Team Server components). The root cause is the use of weaker than expected encryption, enabling local users to obtain sensitive information. Affected versions include CL...

CVE-2015-7474

CVE-2015-7474 is a stored cross-site scripting vulnerability in the IBM Jazz Foundation / Rational Engineering Lifecycle Manager (RELM) affecting multiple CLM components. A remote attacker can inject arbitrary web script or HTML via unspecified vectors, potentially stealing cookies or session dat...

CVE-2016-9700

IBM CVE-2016-9700 (IBM Jazz Foundation) enables an authenticated attacker to obtain sensitive information from error message stack traces. Affected products include Rational CLM, RDNG, RELM, RTC, RQM, Rhapsody DM, RSA DM, and Rational software architecture components, with versions ranging in CLM...

CVE-2018-1539

CVE-2018-1539 affects IBM Rational Engineering Lifecycle Manager versions 5.0–5.02 and 6.0–6.0.6. The issue allows remote attackers to bypass authentication via a direct request or forced browsing to a URL outside the intended page. Public details in connected IBM advisories describe this as an a...

CVE-2015-0112

CVE-2015-0112 maps to an XML External Entity (XXE) issue in IBM Jazz Foundation/CLM stack (Jazz Team Server and multiple CLM-based products). Affected: CLM 3.0.1–5.0.2, RRC 2.0–4.0.7, RDNG 4.x–5.0.2, RELM 1.0/4.0.3–5.0.2, Rhapsody DM 3.0–5.0, RSA DM 3.0–5.0, RTC 2.0–5.0.2, RQM 2.0–5.0.2. Impact: ...

CVE-2016-2926

CVE-2016-2926 is an XSS vulnerability affecting IBM Jazz-based CLM suite (Rational CLM, RQM, RTC, RDNG, RELM, Rhapsody DM, RSA DM) and related products. The issue arises from improper validation of input, allowing remote authenticated users to inject arbitrary script via crafted URLs. Impact incl...

CVE-2018-1914

CVE-2018-1914 affects IBM Rational Engineering Lifecycle Manager (REL M) 5.0 through 6.0.6. The root cause is a cross-site scripting vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Public records ...

CVE-2015-7486

CVE-2015-7486 is a cross-site scripting (XSS) vulnerability in IBM Rational Engineering Lifecycle Manager (RELM) affecting multiple CLM-related products. The issue stems from improper validation of user-supplied input, allowing remote attackers to inject arbitrary web script or HTML via unspecifi...

CVE-2018-1588

The CVE-2018-1588 entry concerns IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0–5.0.2 and 6.0–6.0.6) with a XML External Entity (XXE) vulnerability when processing XML data. Underlying issue: XXE allow remote attackers to exfiltrate sensitive information or consume memory res...

CVE-2018-1846

IBM Rational Engineering Lifecycle Manager (RELM) versions 5.0–5.0.2 and 6.0–6.0.6 are affected by a XML External Entity (XXE) vulnerability in XML data processing. A remote attacker could disclose sensitive information or exhaust memory Resources. A fix is available: upgrade to RELM 6.0.6 with i...

CVE-2018-1929

IBM Rational Engineering Lifecycle Manager (RELM) versions 5.0–6.0.6 are affected by an information-disclosure vulnerability: a malicious user who knows the URL to any view can access information they should not see. CVSS v3 base score 4.3 (MEDIUM); attack vector NETWORK; privileges required LOW;...

CVE-2016-9735

CVE-2016-9735 is an IBM Jazz Foundation information-disclosure vulnerability. An authenticated user could obtain sensitive information from stack traces. Affected products span IBM Jazz-based applications: CLM, RDNG, RELM, RTC, RQM, Rhapsody Design Manager, and RSA Design Manager. Affected versio...