CVE-2018-1478

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly laun...

CVE-2018-1480

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-1485

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970...

CVE-2018-1476

CVE-2018-1476 affects IBM BigFix Platform 9.2.0–9.2.14 and 9.5–9.5.9, where sensitive information is disclosed to unauthorized users. The NVD entry describes this as an information-disclosure vulnerability that can be used to mount further attacks on the system. The provided documents do not spec...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-21187)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9. A local attacker could exploit the vulnerability to read user credentials...

Code injection

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

CVE-2017-1231 affects IBM BigFix Platform 9.5 (9.5.0 to 9.5.9). The root cause is storing user credentials in plaintext on the server, allowing a local attacker to read them. Public references from NVD/CNVD/Nessus indicate an information-disclosure vulnerability with high impact when exposed loca...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise, and products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise and supporting products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerability Details CVEID:...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-11073)

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. An information disclosure vulnerability exists in IBM BigFix Platform. The vulnerability arises from the software transmitting sensitive or safety critical data in clear text over a channel that can be sniff...

Code injection

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

CVE-2018-1600

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

CVE-2018-1600

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

CVE-2018-1600

CVE-2018-1600 affects IBM BigFix Platform 9.2 and 9.5, where sensitive or security-critical data is transmitted in clear text over a network channel that can be sniffed by an attacker. The root cause is insecure plain-text transmission within the affected components. Documented impact includes po...

CVE-2018-1600

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...

IBM BigFix Platform Cross-Site Request Forgery Vulnerability

IBM BigFix platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A cross-site request forgery vulnerability exists in the BigFix Relay Diagnostic page in IBM BigFix Platform versions 9.2 and 9.5. A remote attacker could exploit the...

IBM BigFix Platform Brute Force Vulnerability

IBM BigFix platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in the BigFix Relay Diagnostic page in IBM BigFix Platform versions 9.2 and 9.5, which stems from the program failing to limit the...