CVE-2017-1200

CVE-2017-1200 affects IBM BigFix Compliance 1.7–1.9.91 (TEMA SUAv1 SCA SCM). The issue is improper certificate validation: the product does not validate, or validates incorrectly, a TLS/SSL certificate, which could allow an attacker to perform a man‑in‑the‑middle (MITM) attack by spoofing a trust...

CVE-2017-1177

CVE-2017-1177 affects IBM BigFix Compliance 1.7–1.9.91, disclosing sensitive information to unauthorized users. Reported as a medium-severity issue (CVSS v2 base 5.0; CVSS v3 base 5.3) with network vector and no user interaction required. The material notes potential to mount further attacks usin...

CVE-2017-1198

IBM BigFix Compliance 1.7 through 1.9.91 TEMA SUAv1 SCA SCM stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 123673...

CVE-2017-1202

CVE-2017-1202 affects IBM BigFix Compliance 1.7–1.9.91 (TEMA SUAv1 SCA SCM). The vulnerability is HTML injection that could allow a remote attacker to inject HTML code, which would execute in the victim’s browser within the hosting site’s security context when viewed. No exploitation details or p...

CVE-2017-1177

IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123429...

CVE-2017-1198

CVE-2017-1198 affects IBM BigFix Compliance 1.7–1.9.91 (TEMA SUAv1 SCA SCM). The underlying issue is that sensitive information is stored in URL parameters, enabling potential information disclosure if URLs are exposed in server logs, referrer headers, or browser history. The NVD entry notes expl...

CVE-2017-1202

IBM BigFix Compliance 1.7 through 1.9.91 TEMA SUAv1 SCA SCM is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 123677...

CVE-2017-1200

IBM BigFix Compliance 1.7 through 1.9.91 TEMA SUAv1 SCA SCM does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. The software might connect to a malicious host while believing it is a...

IBM BigFix Platform 9.2.x < 9.2.15 / 9.5.x < 9.5.10 Multiple Vulnerabilities

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.2.x prior to 9.2.15, or 9.5.x prior to 9.5.10. It is, therefore, affected by multiple vulnerabilities : - IBM BigFix Platform is vulnerable to HTTP response splitting attacks, caused by...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-26898)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform that originates from the program failing to set the 'HttpOnly' attribute of an authorization token or session...

IBM BigFix Platform HTTP Response Splitting Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform that originates when the program incorrectly validates user-submitted input. A remote attacker could exploit th...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-26899)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform, which stems from the program's failure to set the security properties of authorization tokens or session...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-25407)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. An information disclosure vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which originates when a program stores...

IBM BigFix Platform Session Fixation Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A session fixation vulnerability in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which stems from the program's failure to update session...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-25405)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. An information disclosure vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which can be exploited by an attacker to gain...

IBM BigFix Platform Clickjacking Vulnerability

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A clickjacking vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9 and 9.2 through 9.2.14, which can be exploited by remote attackers with the help...

CVE-2018-1480

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-1484

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2018-1485

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970...