Information disclosure

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123860...

CVE-2017-1228

The CVE-2017-1228 entry concerns IBM Tivoli Endpoint Manager/IBM BigFix Platform 9.2 and 9.5. The issue is an information-disclosure vulnerability caused by failing to properly enable the secure cookie attribute, enabling an attacker to obtain sensitive data via man-in-the-middle techniques. Impa...

CVE-2017-1228

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable the secure cookie attribute. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2017-1225

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 123904...

CVE-2017-1226

CVE-2017-1226 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The vulnerability stems from error logging that may include sensitive environmental information, enabling potential attackers to gather details for follow-on actions. Affected component: error messages l...

CVE-2017-1226

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 generates an error message in error logs that includes sensitive information about its environment which could be used in further attacks against the system. IBM X-Force ID: 123905...

CVE-2017-1232

CVE-2017-1232 affects IBM BigFix Platform (formerly IBM Tivoli Endpoint Manager) 9.2.x before 9.2.12 and 9.5.x before 9.5.7. The vulnerability is information disclosure due to transmitting sensitive data in plaintext over a sniffable network channel. Impact is partial confidentiality loss; no int...

CVE-2017-1232

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 123911...

CVE-2017-1225

CVE-2017-1225 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x before 9.2.12 and 9.5.x before 9.5.7. The issue is information disclosure caused by sensitive data in URL parameters, which can be exposed via server logs, referrer headers, or browser history. Remediation suggeste...

CVE-2017-1521

IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2017-1521

Summary: CVE-2017-1521 affects IBM BigFix Platform (formerly IBM Tivoli Endpoint Manager) Web UI in 9.2.x prior to 9.2.12 or 9.5.x prior to 9.5.7, allowing an attacker to embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session (cross-site scripting). Aff...

CVE-2017-1230

CVE-2017-1230 affects the IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The root cause is the use of insufficiently random numbers/values in a security context that depends on unpredictable numbers, enabling potential attackers to guess tokens or identifiers and expose s...

CVE-2017-1220

CVE-2017-1220 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2 and 9.5. The connected documents describe an information disclosure vulnerability where sensitive data is exposed to unauthorized users, enabling potential follow-on attacks. The root cause details are not explicitly...

CVE-2017-1220

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123860...

CVE-2017-1222

CVE-2017-1222 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The root cause is a missing authentication check on a critical resource or function, allowing anonymous users to access protected areas. Public sources in the connected documents corroborate this: multip...

CVE-2017-1230

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. This weakness may allow attackers to expose sensitive information by guessing tokens or identifiers. IBM X-Force ID: 123909...

CVE-2017-1222

IBM Tivoli Endpoint Manager IBM BigFix Platform 9.2 and 9.5 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force ID: 123862...

The vulnerability of the IBM Tivoli Endpoint Manager automation tool, which is part of the BigFix IT equipment management platform, allows a hacker to trigger an emergency shutdown of the system.

The vulnerability of the IBM Tivoli Endpoint Manager automation tool, a unified management platform for IT equipment, is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to trigger an emergency shutdown of the system resulting in memory resource...

IBM Tivoli Endpoint Manager Multiple Vulnerabilities (Aug 2017)

IBM Tivoli Endpoint Manager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

IBM BigFix Platform Tivoli Endpoint Manager Denial of Service Vulnerability

IBM BigFix Platform is a dynamic set of integrated messaging content-driven and management system multi-technology platform from IBM, U.S.A. Tivoli Endpoint Manager is one of the endpoint control software. The software helps users view and update systems, deploy and manage patches to all endpoint...