CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2008-5326
https://notcve.org/view.php?id=CVE-2008-5326
05 Dec 2008 — The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 on Windows allows local users to obtain (1) user and (2) database passwords by using a password revealer utility on a field containing a series of asterisks. La herramienta ClearQuest Maintenance en IBM Rational ClearQuest v7.0.0 anterior a la v7.0.0.4 v7.0.1 anterior a la v7.0.1.3 en Windows permitiría a usuarios locales obtener (1) usuario y (2) contraseñas de la base de datos mediante una utilidad de ... • http://secunia.com/advisories/32847 • CWE-255: Credentials Management Errors •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2008-5325
https://notcve.org/view.php?id=CVE-2008-5325
05 Dec 2008 — Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de secuencias de ejecución de comandos en sitios cruzados en CQ Web en IBM Rational ClearQuest v7.0.0 anterior a la v7.0.0.4 y 7.0.1 anterior a la v7.0.1.3 permitiría a atacantes remotos inyectar secuencias de comandos web o HTML a su elección a través de vectore... • http://secunia.com/advisories/32847 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 2%CPEs: 7EXPL: 1CVE-2008-5330 – IBM Rational ClearCase 7/8 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-5330
05 Dec 2008 — Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4, and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1 versions before 7.0.1.3, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO of a URI associated with a VOB page. Múltiples vulnerabilidades de secuencias de ejecución de comandos en sitios cruzados en la interfaz web de ClearCase RWP server en IBM Rational ClearCase v7.0.0 anterior a ... • https://www.exploit-db.com/exploits/32631 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 19%CPEs: 4EXPL: 1CVE-2007-4592 – IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-4592
20 Mar 2008 — Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en la interfaz web para IBM Rational ClearQuest versiones anteriores a 2003.06.16 Parche 2008A, 7.0.0.2_iFix01 y 7.0.... • https://www.exploit-db.com/exploits/31438 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1288
https://notcve.org/view.php?id=CVE-2008-1288
11 Mar 2008 — IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 might allow local or remote attackers to obtain sensitive information about users by reading user cookies. IBM Rational ClearQuest 7.0.1.1 y 7.0.0.2 podrían permitir a atacantes locales o remotos obtener información sensible sobre usuarios mediante la lectura de las cookies de los usuarios. • http://secunia.com/advisories/29280 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1287
https://notcve.org/view.php?id=CVE-2008-1287
11 Mar 2008 — IBM Rational ClearQuest 7.0.1.1 and 7.0.0.2 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames. IBM Rational ClearQuest versiones 7.0.1.1.1 y 7.0.0.0.2, genera diferentes mensajes de error dependiendo de si el nombre de usuario es válido o no válido, lo que permite a los atacantes remotos enumerar los nombres de usuario. • http://secunia.com/advisories/29280 • CWE-16: Configuration •