IBM Rational Clearquest vulnerabilities

42 CVEs affecting IBM Rational Clearquest, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-28796, published 2024-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0708, published 2012-04-22. High severity, CVSS 9.3. EPSS: 31.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote…
CVE-2012-0744, published 2012-08-17. Medium severity, CVSS 5.0. EPSS: 8.3% chance of exploitation in the next 30 days. IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4)…
CVE-2007-4592, published 2008-03-20. Medium severity, CVSS 4.3. EPSS: 4.5% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject…
CVE-2007-4368, published 2007-08-15. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter in a…
CVE-2011-1390, published 2012-05-14. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. SQL injection vulnerability in the Maintenance tool in IBM Rational ClearQuest 7.1.1.x before 7.1.1.9, 7.1.2.x before 7.1.2.6, and 8.x before 8.0.0.2 allows remote attackers to execute arbitrary SQL…
CVE-2008-5325, published 2008-12-05. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in CQ Web in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before 7.0.1.3 allow remote attackers to inject arbitrary web script or HTML…
CVE-2007-5090, published 2007-09-26. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to corrupt data via unspecified vectors.
CVE-2010-4603, published 2010-12-29. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to…
CVE-2008-5330, published 2008-12-05. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the web interface in ClearCase RWP server in IBM Rational ClearCase 7.0.0 before 7.0.0.4, and 7.0.1.1-RATL-RCC-IFIX02 and possibly other 7.0.1…
CVE-2010-2517, published 2010-06-30. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report.

Latest

CVE-2024-28796, published 2024-07-17. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2016-2922, published 2018-08-13. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hostname. It is subject to a…
CVE-2014-0950, published 2018-04-20. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple XML external entity (XXE) vulnerabilities in (1) CQWeb / CM Server, (2) ClearQuest Native client, (3) ClearQuest Eclipse client, and (4) ClearQuest Eclipse Designer components in IBM…
CVE-2015-4996, published 2016-01-02. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors.
CVE-2014-8925, published 2015-03-25. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in ClearQuest Web in IBM Rational ClearQuest 7.1.x before 7.1.2.17, 8.0.0.x before 8.0.0.14, and 8.0.1.x before 8.0.1.7 allows remote attackers to…
CVE-2013-3041, published 2013-10-01. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. The Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to obtain sensitive information from the client-server data stream…
CVE-2013-0598, published 2013-09-28. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the…
CVE-2012-5757, published 2013-03-21. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web Client in IBM Rational ClearQuest 7.1.x before 7.1.2.10 and 8.x before 8.0.0.6 allows remote attackers to inject arbitrary web script or HTML via a…
CVE-2012-5765, published 2012-12-20. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a…
CVE-2012-4839, published 2012-12-20. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to conduct phishing attacks via a FRAME element.