CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-5325
https://notcve.org/view.php?id=CVE-2008-5325
Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de secuencias de ejecución de comandos en sitios cruzados en CQ Web en IBM Rational ClearQuest v7.0.0 anterior a la v7.0.0.4 y 7.0.1 anterior a la v7.0.1.3 permitiría a atacantes remotos inyectar secuencias de comandos web o HTML a su elección a través de vectores no específicos. • http://secunia.com/advisories/32847 http://www-01.ibm.com/support/docview.wss?uid=swg1PK69316 http://www.osvdb.org/50369 http://www.securityfocus.com/bid/32576 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2008-5327
https://notcve.org/view.php?id=CVE-2008-5327
The ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database password in cleartext in an object in a ClearQuest connection profile or export file, which allows remote authenticated users to obtain sensitive information by locating the password object within the object tree. La herramienta ClearQuest Maintenance en IBM Rational ClearQuest v7 anterior a la v7.1 almacena la contraseña de la base de datos en texto claro en un objeto en un perfil de conexión de ClearQuest o un fichero de exportación, que permitiría a usuarios remotos autenticados obtener información sensible localizando el objeto contraseña en el árbol de objetos. • http://secunia.com/advisories/32847 http://www-01.ibm.com/support/docview.wss?uid=swg1PK65908 https://exchange.xforce.ibmcloud.com/vulnerabilities/46995 • CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2007-4592 – IBM Rational ClearQuest 7.0 - Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2007-4592
Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en la interfaz web para IBM Rational ClearQuest versiones anteriores a 2003.06.16 Parche 2008A, 7.0.0.2_iFix01 y 7.0.1.1_iFix01, permiten a los atacantes remotos inyectar script web o HTML arbitrario por medio de los parámetros (1) contextid , (2) username, (3) userNameVal y (4) schema en el componente login. IBM Rational ClearQuest Web suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/31438 http://secunia.com/advisories/29467 http://securityreason.com/securityalert/3753 http://www.securityfocus.com/archive/1/489861/100/0/threaded http://www.securityfocus.com/bid/28296 http://www.securitytracker.com/id?1019685 http://www.vupen.com/english/advisories/2008/0952/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41328 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2007-5090
https://notcve.org/view.php?id=CVE-2007-5090
Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to corrupt data via unspecified vectors. Vulnerabilidad sin especificar en el IBM Rational ClearQuest (CQ), cuando se utilizan las bases de datos Microsoft SQL Server o IBM DB2, permite a atacantes remotos corromper los datos a través de vectores sin especificar. • http://osvdb.org/40598 http://secunia.com/advisories/26899 http://www-1.ibm.com/support/docview.wss?uid=swg21268116 http://www.securityfocus.com/bid/25810 http://www.securitytracker.com/id?1018735 http://www.vupen.com/english/advisories/2007/3264 https://exchange.xforce.ibmcloud.com/vulnerabilities/36771 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 76%CPEs: 2EXPL: 3CVE-2007-4368 – IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
https://notcve.org/view.php?id=CVE-2007-4368
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter in a GenerateMainFrame command. Una vulnerabilidad de inyección SQL en /main en IBM Rational ClearQuest (CQ) Web versiones 7.0.0.0.0-IFIX02 y 7.0.0.0.1, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio del parámetro username en un comando GenerateMainFrame. • https://www.exploit-db.com/exploits/4286 http://osvdb.org/36478 http://securityreason.com/securityalert/3012 http://www.securityfocus.com/archive/1/476475/100/0/threaded http://www.securityfocus.com/bid/25324 http://www.securitytracker.com/id?1018569 https://exchange.xforce.ibmcloud.com/vulnerabilities/36012 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •