Bigfix Platform (Ibm) - vulnerabilities (CVEs)

44 CVEs, 0 in the last 30 days, 65 known versions, newest CVE from 2019-05-20. Vendor: Ibm.

CVEs of Bigfix Platform

CVE-2019-4011 - CVSS 5.4 (medium), 2019-05-20: IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2018-2005 - CVSS 3.3 (low), 2019-05-20: IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions.…
CVE-2019-4058 - CVSS 6.5 (medium), 2019-05-20: IBM BigFix Platform 9.2 and 9.5 could allow a low-privilege user to manipulate the UI into exposing interface elements and information normally restricted to…
CVE-2019-4013 - CVSS 9.9 (critical), 2019-04-10: IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code…
CVE-2019-4061 - CVSS 5.3 (medium), 2019-02-27: IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the updates and fixlets deployed to the…
CVE-2018-1481 - CVSS 5.3 (medium), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if…
CVE-2018-1480 - CVSS 5.3 (medium), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a…
CVE-2018-1485 - CVSS 4.3 (medium), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session…
CVE-2018-1484 - CVSS 3.7 (low), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be…
CVE-2018-1476 - CVSS 7.5 (high), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. The information can be used to mount…
CVE-2018-1474 - CVSS 6.1 (medium), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of…
CVE-2018-1478 - CVSS 6.1 (medium), 2018-12-12: IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a…
CVE-2017-1231 - CVSS 7.8 (high), 2018-10-12: IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910.
CVE-2018-1600 - CVSS 8.6 (high), 2018-06-04: IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized…
CVE-2018-1479 - CVSS 8.8 (high), 2018-04-27: IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
CVE-2018-1475 - CVSS 9.8 (critical), 2018-04-27: IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force…
CVE-2018-1473 - CVSS 6.1 (medium), 2018-04-27: IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2016-0295 - CVSS 8.8 (high), 2018-02-28: Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the…
CVE-2016-0291 - CVSS 8.8 (high), 2018-02-28: IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server…
CVE-2017-1221 - CVSS 9.8 (critical), 2017-11-13: IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it easier for attackers…
CVE-2017-1229 - CVSS 5.9 (medium), 2017-11-13: IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable…
CVE-2017-1228 - CVSS 3.7 (low), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly…
CVE-2017-1521 - CVSS 6.1 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-site scripting.…
CVE-2017-1220 - CVSS 5.3 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) discloses sensitive information to unauthorized users. The information can be used to mount…
CVE-2017-1226 - CVSS 4.3 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes sensitive information about its…
CVE-2017-1232 - CVSS 5.9 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) transmits sensitive or security-critical data in cleartext in a communication channel that can…
CVE-2017-1225 - CVSS 5.3 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) stores sensitive information in URL parameters. This may lead to information disclosure if…
CVE-2017-1230 - CVSS 5.3 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that depends on unpredictable…
CVE-2017-1222 - CVSS 6.5 (medium), 2017-10-26: IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) does not perform an authentication check for a critical resource or functionality allowing…
CVE-2017-1227 - CVSS 7.5 (high), 2017-07-31: IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906.
CVE-2017-1219 - CVSS 6.5 (medium), 2017-07-19: IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
CVE-2017-1218 - CVSS 8.8 (high), 2017-07-19: IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
CVE-2017-1224 - CVSS 7.5 (high), 2017-07-19: IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM…
CVE-2017-1203 - CVSS 6.1 (medium), 2017-07-19: IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to…
CVE-2017-1223 - CVSS 6.1 (medium), 2017-07-19: IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a…
CVE-2016-0214 - CVSS 7.8 (high), 2017-02-08: IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious…
CVE-2016-6082 - CVSS 10 (critical), 2017-02-01: IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could…
CVE-2016-6085 - CVSS 6.5 (medium), 2017-02-01: IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers.
CVE-2016-6084 - CVSS 6.5 (medium), 2017-02-01: IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request.
CVE-2016-0296 - CVSS 3.3 (low), 2017-02-01: IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.
CVE-2016-0396 - CVSS 8.1 (high), 2017-02-01: IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than…
CVE-2016-0297 - CVSS 3.7 (low), 2017-02-01: IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP…
CVE-2016-0293 - CVSS 6.1 (medium), 2016-09-01: Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote…
CVE-2016-0269 - CVSS 5.4 (medium), 2016-07-15: Cross-site scripting (XSS) vulnerability in IBM BigFix Platform 9.x before 9.1.8 and 9.2.x before 9.2.7 allows remote authenticated users to inject arbitrary…