Ibm Rational Clearquest vulnerabilities

42 known vulnerabilities affecting ibm/rational_clearquest.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL2HIGH6MEDIUM31LOW3

Vulnerabilities

Page 1 of 3

CVE-2024-28796MEDIUMCVSS 5.4≥ 9.1, < 9.1.0.72024-07-17

CVE-2024-28796 [MEDIUM] CWE-79 CVE-2024-28796: IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerabi IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 286833.

nvd

CVE-2016-2922MEDIUMCVSS 5.9≥ 8.0.0.0, ≤ 8.0.0.21≥ 8.0.1.0, ≤ 8.0.1.17+53 more2018-08-13

CVE-2016-2922 [LOW] CWE-295 CVE-2016-2922: IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) f IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a man-in-the-middle attack with an impersonating server observing all the data transmitted to the real server. IBM X-Force ID: 113353.

cvelistv5nvd

CVE-2014-0950HIGHCVSS 7.1≥ 7.1.1, ≤ 7.1.1.9≥ 7.1.2, ≤ 7.1.2.13+2 more2018-04-20

CVE-2014-0950 [HIGH] CWE-611 CVE-2014-0950: Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native c Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM Rational ClearQuest 7.1.1 through 7.1.1.9, 7.1.2 through 7.1.2.13, 8.0.0 through 8.0.0.10, and 8.0.1 through 8.0.1.3 allow remote attackers to cause a denial of se

nvd

CVE-2015-4996MEDIUMCVSS 5.1v7.1v7.1.0.1+50 more2016-01-02

CVE-2015-4996 [MEDIUM] CWE-200 CVE-2015-4996: IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local u IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors.

nvd

CVE-2014-8925MEDIUMCVSS 6.8v7.1v7.1.0.1+46 more2015-03-25

CVE-2014-8925 [MEDIUM] CWE-352 CVE-2014-8925: Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x b Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout or insert XSS sequences.

nvd

CVE-2013-3041MEDIUMCVSS 4.3v7.1v7.1.0.1+32 more2013-10-01

CVE-2013-3041 [MEDIUM] CVE-2013-3041: The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream via unspecified vectors associated with a "JSON hijacking attack."

nvd

CVE-2013-0598MEDIUMCVSS 6.8v7.1.1.1v7.1.1.2+27 more2013-09-28

CVE-2013-0598 [MEDIUM] CWE-352 CVE-2013-0598: Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 bef Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the authentication of arbitrary users.

nvd

CVE-2012-5757MEDIUMCVSS 4.3v7.1.1.1v7.1.1.2+22 more2013-03-21

CVE-2012-5757 [MEDIUM] CWE-79 CVE-2012-5757: Cross-site scripting (XSS) vulnerability in the Web Client in IBM Rational ClearQuest 7.1.x before 7 Cross-site scripting (XSS) vulnerability in the Web Client in IBM Rational ClearQuest 7.1.x before 7.1.2.10 and 8.x before 8.0.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

nvd

CVE-2012-5765MEDIUMCVSS 5.0v7.1.2v7.1.2.1+12 more2012-12-20

CVE-2012-5765 [MEDIUM] CWE-200 CVE-2012-5765: The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0 The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message.

nvd

CVE-2012-4839MEDIUMCVSS 4.3v7.1.2v7.1.2.1+12 more2012-12-20

CVE-2012-4839 [MEDIUM] CVE-2012-4839: The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to conduct phishing attacks via a FRAME element.

nvd

CVE-2012-2168MEDIUMCVSS 4.0v7.1.1.1v7.1.1.2+16 more2012-08-17

CVE-2012-2168 [MEDIUM] CWE-200 CVE-2012-2168: IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated user IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to obtain sensitive stack-trace information from CM server error messages via an invalid parameter.

nvd

CVE-2012-0744MEDIUMCVSS 5.0PoCv7.1.1.1v7.1.1.2+17 more2012-08-17

CVE-2012-0744 [MEDIUM] CWE-200 CVE-2012-0744: IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obt IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4) hitcount, (5) HitCount.jsp, (6) HelloHTMLError.jsp, (7) HelloHTML.jsp, (8) HelloVXMLError.jsp, (9) HelloVXML.jsp, (10) HelloWMLError.jsp, (11) HelloWML.jsp, or

nvd

CVE-2012-2164MEDIUMCVSS 5.5v7.1.1.1v7.1.1.2+16 more2012-08-17

CVE-2012-2164 [MEDIUM] CWE-264 CVE-2012-2164: The Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote The Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to bypass intended access restrictions, and use the Site Administration menu to modify system settings, via a parameter-tampering attack.

nvd

CVE-2012-2169LOWCVSS 3.5v7.1.1.1v7.1.1.2+13 more2012-08-17

CVE-2012-2169 [LOW] CWE-79 CVE-2012-2169: Cross-site scripting (XSS) vulnerability in the file-upload functionality in the Web client in IBM R Cross-site scripting (XSS) vulnerability in the file-upload functionality in the Web client in IBM Rational ClearQuest 7.1.x before 7.1.2.7 allows remote authenticated users to inject arbitrary web script or HTML via the File Description field.

nvd

CVE-2012-2165LOWCVSS 3.5v7.1.1.1v7.1.1.2+16 more2012-08-17

CVE-2012-2165 [LOW] CWE-200 CVE-2012-2165: IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication is enabled, allows remote authenticated users to read password hashes via a user query.

nvd

CVE-2012-2205LOWCVSS 3.5v7.1.1.1v7.1.1.2+16 more2012-08-17

CVE-2012-2205 [LOW] CWE-79 CVE-2012-2205: Cross-site scripting (XSS) vulnerability in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x bef Cross-site scripting (XSS) vulnerability in IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via a workspace query.

nvd

CVE-2011-1390HIGHCVSS 7.5v7.1.1.1v7.1.1.2+14 more2012-05-14

CVE-2011-1390 [HIGH] CWE-89 CVE-2011-1390: SQL injection vulnerability in the Maintenance tool in IBM Rational ClearQuest 7.1.1.x before 7.1.1. SQL injection vulnerability in the Maintenance tool in IBM Rational ClearQuest 7.1.1.x before 7.1.1.9, 7.1.2.x before 7.1.2.6, and 8.x before 8.0.0.2 allows remote attackers to execute arbitrary SQL commands by leveraging an error in the user-database upgrade feature.

nvd

CVE-2012-0708CRITICALCVSS 9.3PoCv7.1.1v7.1.1.1+12 more2012-04-22

CVE-2012-0708 [CRITICAL] CWE-119 CVE-2012-0708: Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a RegisterSchemaRepoFromFileByDbSet function-prototype mismatch.

nvd

CVE-2011-1205MEDIUMCVSS 6.9v7.0.0.4v7.0.0.5+24 more2011-03-29

CVE-2011-1205 [MEDIUM] CWE-119 CVE-2011-1205: Multiple buffer overflows in unspecified COM objects in Rational Common Licensing 7.0 through 7.1.1. Multiple buffer overflows in unspecified COM objects in Rational Common Licensing 7.0 through 7.1.1.4 in IBM Rational ClearCase 7.0.0.4 through 7.1.1.4, ClearQuest 7.0.0.4 through 7.1.1.4, and other products allow local users to gain privileges via a Trojan horse HTML document in the My Computer zone.

nvd

CVE-2010-4601CRITICALCVSS 10.0v7.0v7.0.0.0+25 more2010-12-29

CVE-2010-4601 [CRITICAL] CVE-2010-4601: Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x befor Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 allow attackers to have an unknown impact via vectors related to third-party .ocx files.

nvd

1 / 3Next →