CVE-2018-1476

CVE-2018-1476 affects IBM BigFix Platform 9.2.0–9.2.14 and 9.5–9.5.9, where sensitive information is disclosed to unauthorized users. The NVD entry describes this as an information-disclosure vulnerability that can be used to mount further attacks on the system. The provided documents do not spec...

CVE-2018-1478

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly laun...

CVE-2018-1484

CVE-2018-1484 affects IBM BigFix Platform versions 9.2.0–9.2.14 and 9.5–9.5.9. The root cause is that authorization tokens and session cookies are not marked with the Secure attribute, allowing the cookies to be sent over insecure links. An attacker could obtain cookie values by luring a user to ...

CVE-2018-1474

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split respons...

CVE-2018-1480

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user...

CVE-2018-1480

CVE-2018-1480 affects IBM BigFix Platform versions 9.2.0–9.2.14 and 9.5–9.5.9. The root cause is that authorization tokens or session cookies are not marked HttpOnly, which could allow a client-side script to access cookies in the presence of a Cross-Site Scripting vulnerability, enabling potenti...

CVE-2018-1484

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2018-1474

IBM BigFix Platform is affected by HTTP response splitting (CVE-2018-1474). Affected versions: 9.2.0–9.2.14 and 9.5–9.5.9. Exploitation could inject arbitrary HTTP headers, enabling cache poisoning or cross-site scripting. According to Nessus, remediation is to upgrade to 9.2.15 or 9.5.10. No add...

CVE-2018-1476

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 140757...

CVE-2018-1485

Summary: CVE-2018-1485 affects IBM BigFix Platform. From the sources, versions 9.2.0–9.2.14 and 9.5–9.5.9 do not renew a session variable after successful authentication, enabling session fixation/hijacking via a cookie that may be known to an attacker. Affected software: IBM BigFix Platform (9.2...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-21187)

IBM BigFix Platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A security vulnerability exists in IBM BigFix Platform versions 9.5 through 9.5.9. A local attacker could exploit the vulnerability to read user credentials...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

Code injection

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

CVE-2017-1231

CVE-2017-1231 affects IBM BigFix Platform 9.5 (9.5.0 to 9.5.9). The root cause is storing user credentials in plaintext on the server, allowing a local attacker to read them. Public references from NVD/CNVD/Nessus indicate an information-disclosure vulnerability with high impact when exposed loca...

CVE-2017-1231

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise, and products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM Cloud Orchestrator, IBM Cloud Orchestrator Enterprise and supporting products shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerability Details CVEID:...

IBM BigFix Platform Information Disclosure Vulnerability (CNVD-2018-11073)

IBM BigFix Platform formerly IBM Tivoli Endpoint Manager is a system management software. An information disclosure vulnerability exists in IBM BigFix Platform. The vulnerability arises from the software transmitting sensitive or safety critical data in clear text over a channel that can be sniff...

Code injection

IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745...