CVE-2017-1219

CVE-2017-1219 describes an XML External Entity (XXE) injection vulnerability in IBM Tivoli Endpoint Manager (now IBM BigFix Platform). The issue arises while processing XML data, allowing a remote attacker to disclose sensitive information or exhaust memory resources. Connected sources consistent...

CVE-2017-1223

CVE-2017-1223 refers to an open redirection vulnerability in IBM Tivoli Endpoint Manager (IBM BigFix Platform). A remote attacker can lure a user to a crafted site to spoof the displayed URL and redirect to a malicious site, enabling phishing and potentially exposing sensitive information or enab...

CVE-2017-1224

CVE-2017-1224 affects IBM Tivoli Endpoint Manager (BigFix) and is described in connected sources as a cryptographic weakness that could allow an attacker to decrypt highly sensitive information. The core issue is the use of weaker-than-expected cryptographic algorithms in Tivoli Endpoint Manager....

CVE-2017-1203

IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2017-1223

IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web...

PT-2017-12419

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager affected versions not specified Description The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, the attacker...

PT-2017-12393

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager affected versions not specified Description The issue allows a remote attacker to expose sensitive information or consume memory resources through a XML External Entity Injection XXE attack when processing XML data...

CVE-2017-1218: Cross-Site Request Forgery (CSRF)

IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 123858...

PT-2017-12383

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager affected versions not specified Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting malicious actions...

CVE-2017-1219: Improper Restriction of XML External Entity Reference

IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 123859...

CVE-2017-1223: URL Redirection to Untrusted Site

IBM Tivoli Endpoint Manager could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web...

PT-2017-12325

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...

PT-2017-12420

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager affected versions not specified Description The issue concerns the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations At the...

CVE-2017-1224: Inadequate Encryption Strength

IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903...

CVE-2017-1203: Improper Neutralization of Input During Web Page Generation

IBM Tivoli Endpoint Manager for Lifecycle/Power/Patch Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2017-1178

IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Cross site scripting

IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2017-1178

IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2017-1178

IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2017-1178

CVE-2017-1178 affects IBM Endpoint Manager for Security and Compliance / IBM BigFix Compliance Analytics Web UI (version 1.9.70). The vulnerability is a stored cross-site scripting (XSS) flaw in the Web UI analytics component caused by improper input validation, allowing an unauthenticated remote...