CVSS: 3.5EPSS: 0%CPEs: 21EXPL: 0CVE-2015-0123
https://notcve.org/view.php?id=CVE-2015-0123
Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122. Vulnerabilidad de XSS en IBM Rational Team Concert 2.x y 3.x anterior a 3.0.1.6 iFix 5, 4.x anterior a 4.0.7 iFix3, y 5.x anterior a 5.0.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de una URL manipulada, una vulnerabilidad diferente a CVE-2015-0122. • http://www-01.ibm.com/support/docview.wss?uid=swg21698253 http://www.securityfocus.com/bid/73101 http://www.securitytracker.com/id/1031884 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 105EXPL: 0CVE-2014-3092
https://notcve.org/view.php?id=CVE-2014-3092
IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. IBM Jazz Team Server, utilizado en Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x anterior a 3.0.1.6 iFix 3, 4.x anterior a 4.0.7, y 5.x anterior a 5.0.1; y otros productos Rational, no configura el indicador de seguridad para la cookie de la sesión en una sesión https, lo que facilita a atacantes remotos capturar esta cookie mediante la intercepción de su transmisión dentro de una sesión http. • http://www-01.ibm.com/support/docview.wss?uid=swg21682787 https://exchange.xforce.ibmcloud.com/vulnerabilities/94258 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 17EXPL: 0CVE-2014-3050
https://notcve.org/view.php?id=CVE-2014-3050
IBM Rational Team Concert (RTC) 3.x before 3.0.1.6 IF3 and 4.x before 4.0.7 does not properly integrate with build engines, which allows remote authenticated users to discover credentials via unspecified vectors. IBM Rational Team Concert (RTC) 3.x anterior a 3.0.1.6 IF3 y 4.x anterior a 4.0.7 no integra debidamente con los motores build, lo que permite a usuarios remotos autenticados descubrir las credenciales a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21679192 https://exchange.xforce.ibmcloud.com/vulnerabilities/93436 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 54EXPL: 0CVE-2013-5404
https://notcve.org/view.php?id=CVE-2013-5404
Cross-site scripting (XSS) vulnerability in the search implementation in IBM Rational Quality Manager (RQM) 2.0 through 2.0.1.1, 3.x before 3.0.1.6 iFix 1, and 4.x before 4.0.5, as used in Rational Team Concert, Rational Requirements Composer, and other products, allows remote authenticated users to inject arbitrary web script or HTML via vectors involving an IFRAME element. Vulenrabilidad Cross-site scripting (XSS) en la aplicación de búsqueda en IBM Rational Quality Manager (RQM) 2.0 a 2.0.1.1, 3.0.1.6 3.x antes iFix 1, 4.x antes de 4.0.5, tal como se utiliza en Rational Team Concert, Rational Requirements Composer, y otros productos, permite a usuarios remotos autenticados inyectar web scripts o HTML a través de vectores relacionados con un elemento IFRAME. • http://www-01.ibm.com/support/docview.wss?uid=swg21653689 https://exchange.xforce.ibmcloud.com/vulnerabilities/87318 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2012-0748
https://notcve.org/view.php?id=CVE-2012-0748
Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified services in IBM Rational Team Concert (RTC) 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en servicios no determinado en IBM Rational Team Concert (RTC) v4.x anteriores a v4.0.0.1, permite a atacantes remotos secuestrar la autenticación de usuarios para peticiones que modifican los elementos de trabajo. • http://secunia.com/advisories/50789 http://www-01.ibm.com/support/docview.wss?uid=swg21612356 http://www.securityfocus.com/bid/55730 https://exchange.xforce.ibmcloud.com/vulnerabilities/74736 • CWE-352: Cross-Site Request Forgery (CSRF) •