Design/Logic Flaw

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element...

CVE-2014-4778

CVE-2014-4778 concerns IBM License Metric Tool (LM Tool) v9 and IBM Endpoint Manager for Software Use Analysis v9. The issue: the login page response lacks the X-Frame-Options header, enabling clickjacking through framing of the login page. Connected IBM bulletin confirms this and provides remedi...

CVE-2014-8927

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-4774

CVE-2014-4774 affects IBM License Metric Tool (LM Tool) v9 and IBM Endpoint Manager for Software Use Analysis v9. The login page is vulnerable to CSRF via framing (FRAME) that can hijack user authentication for affected versions before 9.1.0.2. IBM’s security bulletin and related entries confirm ...

CVE-2014-8927

CVE-2014-8927 affects IBM CIT components prior to 2.7.0.2050 in IBM License Metric Tool (7.2.2, 7.5, 9); IBM Endpoint Manager for Software Use Analysis (v9); and Tivoli Asset Discovery for Distributed (7.2.2, 7.5). Root cause is a vulnerability in the XML handling that allows remote attackers to ...

CVE-2014-8926

CVE-2014-8926 affects IBM License Metric Tool (CIT) before 2.7.0.2050 in IBM License Metric Tool v7.2.2, v7.5, and v9; IBM Endpoint Manger for Software Use Analysis v9; and Tivoli Asset Discovery for Distributed v7.2.2 and v7.5. A crafted XML query can cause denial of service via CPU consumption ...

CVE-2014-4778

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element...

CVE-2015-1915

The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by interceptin...

Memory corruption

The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by interceptin...

CVE-2015-1915

The CVE-2015-1915 issue affects IBM Tivoli Endpoint Manager for Lifecycle Management’s Endpoint Manager for Remote Control component. Specifically, 9.0.1 before IF6 and 9.1.0 before IF6 fail to set the secure flag on session cookies in HTTPS sessions, allowing an attacker to capture cookies by in...

CVE-2015-1915

The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by interceptin...

IBM Endpoint Manager crossite scripting

Relay Diagnostics crossite scripting...

[RT-SA-2014-013] Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page

Advisory: Cross-Site Scripting in IBM Endpoint Manager Relay Diagnostics Page During a penetration test, RedTeam Pentesting discovered that the IBM Endpoint Manager Relay Diagnostics page allows anybody to persistently store HTML and JavaScript code that is executed when the page is opened in a...

IBM Tivoli Endpoint Manager Web Reports Component Cross-Site Scripting Vulnerability

IBM Tivoli Endpoint Manager provides a unified, real-time visualization and implementation approach to deploying and managing patches to all endpoints. A cross-site scripting vulnerability in the Web Reports component of IBM Tivoli Endpoint Manager version 9.1.1229 prior to 9.1 can be exploited b...

CVE-2014-6137

Cross-site scripting XSS vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6113

Cross-site scripting XSS vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6137

Cross-site scripting XSS vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-6113

Cross-site scripting XSS vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...