Design/Logic Flaw

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system...

CVE-2016-6085

IBM BigFix Platform (BES Root Server and BES Relay) on the local network is affected by a Denial of Service vulnerability (CVE-2016-6085) due to improper handling of unspecified user-supplied input, which could cause the BES and relay servers to crash. Related advisories reference this alongside ...

CVE-2016-8966

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2016-8981

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system...

CVE-2016-8966

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8966 due to a missing HTTP Strict Transport Security header. The root cause is the improper enablement of HSTS, which could allow a remote attacker to obtain sensitive information via man-in-the-middle techniques....

CVE-2016-8961

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8961 due to a vulnerability where a user-controlled input specifies a link used in an external redirect. An attacker could lure a user to a crafted site to spoof the displayed URL and redirect to a malicious site,...

CVE-2016-6084

IBM BigFix Platform could allow an attacker on the local network to crash the BES server using a specially crafted XMLSchema request...

CVE-2016-8981

CVE-2016-8981 affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x. The issue stems from cache-control/header usage that allows web pages containing sensitive information to be cached locally by a browser, potentially readable by other users on the same system. Impact described as a...

CVE-2016-6085

IBM BigFix Platform could allow an attacker on the local network to crash the BES and relay servers...

CVE-2016-8980

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

CVE-2016-6084

CVE-2016-6084 affects IBM BigFix Platform shipped with IBM Endpoint Manager for Software Use Analysis v2.2. A vulnerability allows an attacker on the local network to crash the BES server by sending a specially crafted XMLSchema request. The IBM security bulletin notes the impact as a crash of th...

CVE-2016-8980

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8980 due to an XML External Entity (XXE) processing flaw in XML handling, enabling denial of service and potential information disclosure. The remediation is to upgrade to IBM BigFix Inventory/License Metric Tool ...

CVE-2016-8961

IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site...

CVE-2016-6082

IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system...

CVE-2016-6082

CVE-2016-6082 affects IBM BigFix Platform (BigFix BES Root Server/Relay) shipped with IBM License Metric Tool v9.x and BigFix Inventory v9.x. Description and connected sources confirm a remote code execution risk caused by a use-after-free race condition, allowing an unauthenticated remote attack...

IBM BigFix Platform 9.x < 9.1.9 / 9.2.x < 9.2.9 / 9.5.x < 9.5.4 Multiple Vulnerabilities

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.x prior to 9.1.9, 9.2.x prior to 9.2.9, or 9.5.x prior to 9.5.4. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to a...

IBM BigFix Platform Denial of Service Vulnerability (CNVD-2017-00315)

IBM BigFix is an endpoint manager from IBM, system management software that can be run on a computer or mobile device, providing remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software catalogs. A denial of service...

IBM License Metric Tool and BigFix Inventory Information Disclosure Vulnerability (CNVD-2017-00327)

The IBM License Metric Tool and BigFix Inventory are both products of IBM Corporation of America. The former is a set of free tools that help IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU licensing needs, and the latter is a soluti...

IBM BigFix Platform Denial of Service Vulnerability

IBM BigFix platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A denial of service vulnerability exists in IBM BigFix Platform versions 9.0 and 9.1. An attacker can exploit the vulnerability by sending a specially crafted XMLSche...

IBM BigFix Platform Remote Code Execution Vulnerability

IBM BigFix platform is a dynamic set of IBM's integrated messaging content-driven and management system multi-technology platform. A remote code execution vulnerability exists in IBM BigFix Platform. A remote attacker could exploit this vulnerability to execute arbitrary code on the system...