The remote host has a version of IBM Rational ClearQuest 7.x prior to 7.1.2.7 / 8.0.0.x prior to 8.0.0.3 installed. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting vulnerability exists that can     be exploited by an attacker by tricking a victim into     opening a specially crafted report. (CVE-2012-2205)

  - An information disclosure vulnerability exists that     allows an attacker unauthorized access to password     information. (CVE-2012-2165)

  - ClearQuest Web sometimes displays sensitive stack trace     information in error messages. (CVE-2012-2168)

  - The ClearQuest Web Help component contains a reflected     cross-site scripting vulnerability. (CVE-2012-2161)

  - Some scripts inside the ClearQuest Web Help application     are vulnerable to open redirect attacks. (CVE-2012-2159)

  - The ClearQuest web client is subject to an elevated     privilege attack that allows an attacker access to the     'Site Administration' menu. (CVE-2012-2164)

  - The ClearQuest web client file-upload functionality is     affected by a cross-site scripting vulnerability that     can be exploited by an authenticated user via the 'File     Description' field. (CVE-2012-2169)

  - Attackers can obtain potentially sensitive information     via a request to a 'snoop', 'hello', 'ivt/', 'hitcount',     'HitCount.jsp', 'HelloHTMLError.jsp', 'HelloHTML.jsp',     'HelloVXMLError.jsp', 'HelloWMLError.jsp',     'HellowWML.jsp' or 'cqweb/j_security_check' sample     script. (CVE-2012-0744)

リモートホストに、7.1.2.7 以前の 7.x / 8.0.0.3 以前の 8.0.0.x の IBM Rational ClearQuest がインストールされています。したがって、次の脆弱性の影響を受けます。

  - A cross-site scripting vulnerability exists that can be exploited by an attacker by tricking a victim into opening a specially crafted report. (CVE-2012-2205)

  - An information disclosure vulnerability exists that allows an attacker unauthorized access to password information. (CVE-2012-2165)

  - ClearQuest Web sometimes displays sensitive stack trace information in error messages. (CVE-2012-2168)

  - The ClearQuest Web Help component contains a reflected cross-site scripting vulnerability. (CVE-2012-2161)

  - Some scripts inside the ClearQuest Web Help application are vulnerable to open redirect attacks. (CVE-2012-2159)

  - The ClearQuest web client is subject to an elevated privilege attack that allows an attacker access to the 'Site Administration' menu. (CVE-2012-2164)

  - The ClearQuest web client file-upload functionality is affected by a cross-site scripting vulnerability that can be exploited by an authenticated user via the 'File Description' field. (CVE-2012-2169)

  - Attackers can obtain potentially sensitive information via a request to a 'snoop', 'hello', 'ivt/', 'hitcount', 'HitCount.jsp', 'HelloHTMLError.jsp', 'HelloHTML.jsp', 'HelloVXMLError.jsp', 'HelloWMLError.jsp', 'HellowWML.jsp' or 'cqweb/j_security_check' sample script. (CVE-2012-0744)

远程主机安装的 IBM Rational ClearQuest 7.x 低于 7.1.2.7/8.0.0.x 低于 8.0.0.3。因此，它受到以下漏洞的影响：

- 存在一个跨站脚本漏洞，攻击者可诱骗受害者打开特别构建的报告来利用该漏洞。(CVE-2012-2205)

- 存在信息泄露漏洞，允许远程攻击者未经授权而访问密码信息。(CVE-2012-2165)

- ClearQuest Web 有时在错误消息中显示敏感的堆栈跟踪信息。(CVE-2012-2168)

- ClearQuest Web Help 组件包含一个反射型跨站脚本漏洞。(CVE-2012-2161)

- ClearQuest Web Help 应用程序内的某些脚本容易受到开放重定向攻击。(CVE-2012-2159)

- ClearQuest Web 客户端易受权限升级攻击，可允许攻击者访问“Site Administration”菜单。(CVE-2012-2164)

- ClearQuest Web 客户端文件上传功能受到跨站脚本漏洞的影响，经认证的用户可通过“File Description”字段利用此漏洞。(CVE-2012-2169)

- 攻击者可通过对“snoop”、“hello”、“ivt/”、“hitcount”、“HitCount.jsp”、“HelloHTMLError.jsp”、“HelloHTML.jsp”、“HelloVXMLError.jsp”、“HelloWMLError.jsp”、“HellowWML.jsp”或“cqweb/j_security_check”示例脚本的请求获取潜在敏感信息。(CVE-2012-0744)

遠端主機上目前安裝的 IBM Rational ClearQuest 是比 7.1.2.7 版舊的 7.x 版/比 8.0.0.3 版舊的 8.0.0.x 版。因此受到以下弱點影響：

- 存在一個跨網站指令碼弱點，攻擊者可惡意利用此弱點，誘騙受害者開啟特製的報告。(CVE-2012-2205)

- 存在一個資訊洩漏弱點，可允許攻擊者未經授權存取密碼資訊。(CVE-2012-2165)

- ClearQuest Web 有時會在錯誤訊息中顯示敏感堆疊追蹤資訊。(CVE-2012-2168)

- ClearQuest Web Help 元件有一個反映式跨網站指令碼弱點。(CVE-2012-2161)

- ClearQuest Web Help 應用程式內的部分指令碼容易遭受開放重新導向攻擊。(CVE-2012-2159)

- ClearQuest web 用戶端容易遭受提升權限攻擊，其可允許攻擊者存取「網站系統管理」功能表。(CVE-2012-2164)

- ClearQuest web 用戶端檔案上傳功能受到跨網站指令碼弱點影響，經驗證的使用者可透過「檔案描述」欄位惡意利用此弱點。(CVE-2012-2169)

- 攻擊者可透過對於 'snoop'、'hello'、'ivt/'、'hitcount'、'HitCount.jsp'、'HelloHTMLError.jsp'、'HelloHTML.jsp'、'HelloVXMLError.jsp'、'HelloWMLError.jsp'、'HellowWML.jsp' 或 'cqweb/j_security_check' 範例指令碼的要求取得潛在的敏感資訊。(CVE-2012-0744)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
61565	IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2012/8/16	2019/12/4	medium
61565	IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3複数の脆弱性（認証情報のチェック)	Nessus	Windows	2012/8/16	2019/12/4	medium
61565	IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3 多种漏洞（凭据检查）	Nessus	Windows	2012/8/16	2019/12/4	medium
61565	IBM Rational ClearQuest 7.x < 7.1.2.7 / 8.0.0.x < 8.0.0.3 多個弱點 (經認證的檢查)	Nessus	Windows	2012/8/16	2019/12/4	medium

検出

プラグインの検索

medium

medium

medium

medium