IBM Rational Jazz Team Server (JTS), as used in Rational Collaborative Lifecycle Management 3.x and 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix5, 4.x before 4.0.7 iFix4, and 5.x before 5.0.2 iFix2; Rational DOORS Next Generation 4.x before 4.0.7 iFix4 and 5.x before 5.0.2 iFix2; Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5; and other products, allows remote authenticated users to read the dashboards of arbitrary users via unspecified vectors.
Monthly Archives: March 2015
CVE-2015-0124 (rational_quality_manager)
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-0125 (rational_doors_next_generation, rational_requirements_composer)
Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 4.x before 4.0.7 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-0128 (rational_quality_manager)
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-0132 (rational_doors_next_generation, rational_requirements_composer)
The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVE-2015-0146 (content_collector)
IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services, which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query.
CVE-2015-0149 (api_management)
The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.
CVE-2015-0178 (liberty)
The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
Women in Tech Speak Out at SXSW
I am in awe of the women who came to my conversation “Boardroom or Baby” at SXSW this past weekend. They were bright, energized, passionate and very engaged in the conversation.
I started the session by asking the women to team up and decide what they believe to be the single most important issue to help women succeed in tech.
As you are probably aware, currently women comprise about only 30% of the tech workforce and make roughly 77 cents on the dollar of what a man makes in tech.
We have a lot of work to do to close the gender gap, but based on the energy coming out of room # 407 at SXSW, I am very hopeful we can get there! I am committed to helping and one of the ways I will contribute is to take each of the items put forth by the group and write a blog offering up counsel on how to successfully navigate the issue. I will be bringing in subject matter experts and life experts to help. Below is the list. If you feel I missed anything please get in touch via Twitter @judyatAVG.
My question to the group was: What is the single most important thing we can do to help women succeed in tech?
Here are their answers in their own words below:
-
Make your career goals known.
-
Speak up and stand up for what you think is right.
-
Don’t let men talk for you; make sure your voice is heard.
-
Work hard.
-
Gain people’s respect.
-
Build and use your network
-
Find a strong female leader in the workplace as a mentor. Break the “Bro” club.
-
Fight against confidence loss when you’re in a room of male leaders.
-
Female diplomacy – speak up
-
Mentorship: Be a mentor to other women and girls. Find a female mentor higher up.
-
Find a sponsor.
-
Create formal sponsor programs, so that men can mentor women without social stigma.
-
Build resources for keeping and supporting a woman’s ability to stay working after she has a baby.
-
Stand up for what we need, realizing the value you bring.
-
Own your own career path to success.
-
Don’t operate from a place of fear.
-
Make people understand that flexibility does not equate to laziness, so don’t be afraid to ask for it.
-
Create awareness on the issue.
-
Make it an issue all care about, not just women.
-
Show the value to the bottom line or success to the business, so everyone is onboard with empowering women.
-
Strip names off of resumes.
-
Reach and speak out to younger girls in elementary school and middle school.
-
De-genderize toys.
-
Speak up in meetings and having a point of view.
-
Build more STEM work in elementary school for young girls.
-
Don’t be the first to tear another woman down.
-
Connect with other women below and beside you and find what you can do to help them achieve their goals.
-
Women should support women.
-
Have a support system in place for mothers.
-
Mentor other women.
-
Find male allies.
-
Get in the mix (female diplomacy).
-
Talk about issues.
-
Remove negative stigma on the term “emotional”.
-
Have more forward conviction in the forward progress we want to see.
-
Educate girls at a young age – letting them know the opportunities are there (Girls who Code).
-
Start off strong. Ask for what you deserve.
-
If you think you can do it go for it!
-
Inner belief: skills, ability, desire.
-
Attitude: stop apologizing, be assertive, and take charge.
-
Maternity leave.
-
Making a “girl playground”.
-
Start girls young in tech.
-
Encourage women not to be afraid to go into a male driven field. Make it welcoming in both culture and environment.
-
Create policies that give flexibility to maternity leave.
I was struck by how many individual issues were highlighted. If you would like to hear about any of these in particular on Twitter, please let me know and I will try to prioritize it.
I plan to address these issues on Twitter as well as a dedicated Facebook page as well as here on the blog.
Remember, change happens when like-minded people band together for a common cause. This is our cause: removing gender bias from the workplace and not allowing women to be penalized for having a baby.
To all the women in tech attending my session at SXSW- and beyond, I thank you and encourage you to stay strong and continue to speak out!
Judith
Regarding how can I request a CVE number?
Posted by XiaopengZhang on Mar 18
Hi Guys,
I discovered several Vuls and have reported them to the vendors, so I’d like to request the CVE for them.(The vendor
did not want to request CVE)
I ever sent some emails to cve-assign () mitre org for applying for CVE.
But so far still nobody replys them. I dont know what happend about this email box.
Is my email recognised as spam? Or do I need write the email content in a special format?
So please, can somebody here help me?…