IBM Rational Clearcase vulnerabilities

19 CVEs affecting IBM Rational Clearcase, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4059, published 2019-02-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6221, published 2015-04-06. High severity, CVSS 9.4. EPSS: 2.7% chance of exploitation in the next 30 days. The MSCAPI/MSCNG interface implementation in GSKit in IBM Rational ClearCase 7.1.2.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 does not properly generate random numbers,…
CVE-2014-0931, published 2018-04-20. Critical severity, CVSS 9.1. EPSS: 2.7% chance of exploitation in the next 30 days. Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) CMAPI Java interface, (4) ClearCase remote client, and (5)…
CVE-2014-3090, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document…
CVE-2014-3101, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt,…
CVE-2014-3106, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not properly implement the Local Access Only protection mechanism, which allows remote attackers to…
CVE-2014-3104, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document…
CVE-2019-4059, published 2019-02-15. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Rational ClearCase 1.0.0.0 GIT connector does not sufficiently protect the document database password. An attacker could obtain the password and gain unauthorized access to the document database.…
CVE-2014-3105, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login…
CVE-2014-3103, published 2014-09-23. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes…
CVE-2014-0829, published 2014-03-21. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote authenticated users to obtain privileged access via…

Latest

CVE-2015-5039, published 2018-03-26. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. The Remote Client and change management integrations in IBM Rational ClearCase 7.1.x, 8.0.0.x before 8.0.0.18, and 8.0.1.x before 8.0.1.11 do not properly validate hostnames in X.509 certificates…
CVE-2014-6134, published 2015-03-25. Low severity, CVSS 1.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Rational ClearCase 8.0.0 before 8.0.0.14 and 8.0.1 before 8.0.1.7, when Installation Manager before 1.8.2 is used, retains cleartext server passwords in process memory throughout the installation…