CVE-2024-28796

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 286833.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	ClearQuest	>= 9.1, <= 9.1.0.6

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/286833VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7160390Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/286833VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7160390Vendor Advisory

Timeline

Published: Jul 17, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-287975.4IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2024-287986.1IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2024-287997.5IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data impr CVE-2024-28802.7An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and CVE-2024-288036.1Cross-site scripting (XSS) vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arb CVE-2024-288047.1An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST.CVE-2024-288059.1An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. There is Incorrect Access Control.CVE-2024-288067.5An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Remote unauthenticated attackers can upload files at an arbitrary path.CVE-2024-288076.5An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management CVE-2024-288082.7An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to ac CVE-2024-288098.8An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers t CVE-2024-28818.8Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows al