CVSS: 5.5EPSS: 0%CPEs: 91EXPL: 0CVE-2014-6129
https://notcve.org/view.php?id=CVE-2014-6129
IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to delete the dashboards of arbitrary users via unspecified vectors. IBM Rational Jazz Team Server (JTS), utilizado en Rational Collaborative Lifecycle Management 3.x y 4.x anterior a 4.0.7 iFix4 y 5.x anterior a 5.0.2 iFix2; Rational Quality Manager 2.x y 3.x anterior a 3.0.1.6 iFix5, 4.x anterior a 4.0.7 iFix4, y 5.x anterior a 5.0.2 iFix2; Rational Team Concert 2.x y 3.x anterior a 3.0.1.6 iFix5, 4.x anterior a 4.0.7 iFix4, y 5.x anterior a 5.0.2 iFix2; Rational DOORS Next Generation 4.x anterior a 4.0.7 iFix4 y 5.x anterior a 5.0.2 iFix2; Rational Requirements Composer 2.x y 3.x anterior a 3.0.1.6 iFix5; y otros productos, permite a usuarios remotos autenticados eliminar los paneles de control de usuarios arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21698247 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2015-0122
https://notcve.org/view.php?id=CVE-2015-0122
Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0123. Vulnerabilidad de XSS en IBM Rational Team Concert 2.x y 3.x anterior a 3.0.1.6 iFix 5, 4.x anterior a 4.0.7 iFix3, y 5.x anterior a 5.0.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada, una vulnerabilidad diferente a CVE-2015-0123. • http://www-01.ibm.com/support/docview.wss?uid=swg21698253 http://www.securityfocus.com/bid/73093 http://www.securitytracker.com/id/1031884 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2015-0123
https://notcve.org/view.php?id=CVE-2015-0123
Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122. Vulnerabilidad de XSS en IBM Rational Team Concert 2.x y 3.x anterior a 3.0.1.6 iFix 5, 4.x anterior a 4.0.7 iFix3, y 5.x anterior a 5.0.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada, una vulnerabilidad diferente a CVE-2015-0122. • http://www-01.ibm.com/support/docview.wss?uid=swg21698253 http://www.securityfocus.com/bid/73101 http://www.securitytracker.com/id/1031884 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 105EXPL: 0CVE-2014-3092
https://notcve.org/view.php?id=CVE-2014-3092
IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. IBM Jazz Team Server, utilizado en Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x anterior a 3.0.1.6 iFix 3, 4.x anterior a 4.0.7, y 5.x anterior a 5.0.1; y otros productos Rational, no configura el indicador de seguridad para la cookie de la sesión en una sesión https, lo que facilita a atacantes remotos capturar esta cookie mediante la intercepción de su transmisión dentro de una sesión http. • http://www-01.ibm.com/support/docview.wss?uid=swg21682787 https://exchange.xforce.ibmcloud.com/vulnerabilities/94258 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •