PT-2019-16872 · Ibm · Ibm Bigfix Platform

Name of the Vulnerable Software and Affected Versions: IBM BigFix Platform versions 9.2 through 9.5 Description: The issue allows an attacker to remotely query the relay and gather information about updates and fixlets deployed to associated sites due to the lack of authenticated access...

IBM BigFix Platform Unauthorized Access Vulnerability

IBM BigFix Platform is a dynamic, content-driven messaging and management system from IBM, USA. An unauthorized access vulnerability exists in BigFix Platform versions 9.5 through 9.5.11 and 9.2 through 9.2.16, which could be exploited by an attacker to obtain information...

IBM BigFix Platform 9.2.x < 9.2.15 / 9.5.x < 9.5.10 Multiple Vulnerabilities

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.2.x prior to 9.2.15, or 9.5.x prior to 9.5.10. It is, therefore, affected by multiple vulnerabilities : - IBM BigFix Platform is vulnerable to HTTP response splitting attacks, caused by...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-26899)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform, which stems from the program's failure to set the security properties of authorization tokens or session...

IBM BigFix Platform HTTP Response Splitting Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform that originates when the program incorrectly validates user-submitted input. A remote attacker could exploit th...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-26898)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform that originates from the program failing to set the 'HttpOnly' attribute of an authorization token or session...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-25407)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. An information disclosure vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which originates when a program stores...

IBM BigFix Platform Session Fixation Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A session fixation vulnerability in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which stems from the program's failure to update session...

IBM BigFix Platform Clickjacking Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A clickjacking vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which can be exploited by remote attackers with the help...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-25405)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. An information disclosure vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which can be exploited by an attacker to gain...

CVE-2018-1485

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970...

CVE-2018-1484

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2018-1480

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-1476

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 140757...

Design/Logic Flaw

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly laun...

CVE-2018-1478

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly laun...

Session fixation

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970...

CVE-2018-1474

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...