|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 2442 CVE : CVE-2007-1468 SecurityRisk : Low  (About) Remote Exploit : Yes Local Exploit : No Exploit Given : No Credit : James Clarke Published : 21.03.2007
Advisory Text : ..........MMMMMMMM. ..... . .. ........7MMMMMMMMMM . .......... . ... ........OMMMMMMMMMM..................... ........8MMNMMMMMMMMMMMMMN.............. ........NMMMMMMMMMMMMMNNNND............. ....,DNMMMMMMMMMMMMMMMNDDD.............. ...DNNNNDMMMMMMMMMMMMMMNI............... ...D8DDNN7MNNMMMMMMMMMMM................ .....D8DN8NMMMMMMMMMMMMMMI.............. ........8MMMNMMMMMMMMMMMMMM............. ...........MMMMMMMMMMMMMMMMMMM.......... ........MMMMMMMMMMMMMMMMMMMMMMMM........ .......MMMMMMMMMMMMMMMMMMMMMMMMMM....... ......MMMMMMMMMMMMMMMMMMMMMMMMMMMM,..... .....MMMMMMMMMMMMMMMMMMMMMMMMMMMMM,..... .....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMM..... ....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM..... ....MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM .... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMNMMM. ... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM:.... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMD.... ...MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN.... ________________________________________________________________________ Vendor: IBM / http://www.ibm.com Affected Products: Rational ClearQuest Web / Version 7.0.0.0 Vulnerability: Cross Site Scripting Risk: HIGH ________________________________________________________________________ Vendor communication: None. ________________________________________________________________________ Overview: Rational ClearQuest provides flexible workflow management, defect and change tracking across the application life cycle for better insight, predictability and control. Description: The flaw was found while logging a defect for another application, only to find out Cq was also vulnerable. Whilst logging a defect, upload a txt file as an attachment to the defect. Put whatever <script></script> you wish into the txt file and it will execute when another user tries to open the attachment. This could lead to session details (cqwebsession, JSESSIONID etc) being disclosed to a third party and used to hijack the users session. Finally, the Cross Site Scripting vulnerability also affects the summary page, which is PHProjekt's index page. ________________________________________________________________________ Credit: Flaw found by James Clarke / clark0r / 15.03.2007 http://www.clarkee.co.uk ________________________________________________________________________  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Multiple Vendors libc/gdtoa printf(3) Array Overrun
SecurityReason realised new advisory about vulnerabilities libc/gdtoa... |
||
| Apache |  |
|
» Apache Tomcat |
||
» Apache Tomcat User |
||
| PHP | |
|
» PHP |
||
- 2009-05-30| Copyright © SecurityReason.com. All Rights Reserved. |