Security Bulletin: Vulnerability in XML Entity Processsing affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8980)

Summary The product does not disable external XML Entity Processsing which can lead to information disclosure and denial of service attacks. Vulnerability Details CVEID: CVE-2016-8980 DESCRIPTION: IBM BigFix Inventory v9.x is vulnerable to a denial of service, caused by an XML External Entity...

Security Bulletin: Vulnerability in password strength policy affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8962)

Summary IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x does not require strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-8962 DESCRIPTION: IBM BigFix Inventory v9.x does not require that users should ha...

Security Bulletin: A security vulnerability has been identified in BigFix Platform shipped with IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-6082)

Summary BigFix Platform BES Root Server and BES Relay is shipped as a component of IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-6082...

Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-2098 CVE-2016-2097)

Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9 and IBM BigFix Inventory v9. Vulnerability Details CVEID: CVE-2016-2098 DESCRIPTION: Ruby on Rails could allow a remote attacker to execute arbitrary code on the system, caused by improper validation o...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9 and IBM BigFix Inventory v9

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool and IBM BigFix Inventory. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017 Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could...

Security Bulletin: Vulnerability in password storage scheme affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8967)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 stores passwords in plain text. Vulnerability Details CVEID: CVE-2016-8967 DESCRIPTION: IBM BigFix Inventory v9 stores user credentials in plain in clear text which can be read by a local user. CVSS Base Score: 6.2 CVSS Temporal Score...

Security Bulletin: Vulnerability in URL Redirection affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8961)

Summary IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. This simplifies phishing attacks. Vulnerability Details CVEID: CVE-2016-8961 DESCRIPTION: IBM BigFix Inventory v9.x could...

Security Bulletin: Vulnerability in HTTP request processing affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8977)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system. Vulnerability Details CVEID: CVE-2016-8977 DESCRIPTION: IBM BigFix...

Security Bulletin: An unspecified vulnerability related to the Java SE JCE component affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2017-10115)

Summary There were multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool LMT and IBM BigFix Inventory BFI. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Fixes are already included in LMT and BFI version 9.2.9 or...

CVE-2022-27545

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...

CVE-2022-27545

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...

CVE-2022-27544

BigFix Web Reports authorized users may see SMTP credentials in clear text...

CVE-2022-27544

BigFix Web Reports authorized users may see SMTP credentials in clear text...

Design/Logic Flaw

BigFix Web Reports authorized users may see SMTP credentials in clear text...

Input validation

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...

CVE-2022-27545 HCL BigFix Web Reports authorized users may perform HTML injection.

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page...

CVE-2022-27545

CVE-2022-27545 affects HCL BigFix Platform (BigFix Web Reports). The issue is an HTML injection vulnerability on the email administrative configuration page that could be exploited by an authorized user to inject malicious scripts into a Web page, potentially compromising user sessions (cookie-ba...

CVE-2022-27544 HCL BigFix Web Reports authorized users may see sensitive information in clear text

BigFix Web Reports authorized users may see SMTP credentials in clear text...

CVE-2022-27544

CVE-2022-27544 affects HCL BigFix Platform (Web Reports): an information disclosure where authorized users can retrieve SMTP credentials in clear text. Root cause is the transfer of SMTP credentials in clear text within Web Reports. Affected product: HCL BigFix Platform/Web Reports. Impact: expos...

HCL BigFix Platform 安全漏洞

HCL Technologies HCL BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform versions 9.5 to 9.5.19,...