CVE-2016-2952: Exposure of Sensitive Information to an Unauthorized Actor

IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...

CVE-2016-2935: Improper Input Validation

The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request...

CVE-2016-2949: Exposure of Sensitive Information to an Unauthorized Actor

IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session...

PT-2016-5296

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 9.1.3, update to version 9.1.3 or later to resolve t...

PT-2016-5295

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows local users to obtain sensitive information by reading cached web pages from a different user's session. Recommendations For versions prior to 9.1.3, update to...

PT-2016-5297

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data, due to the defaul...

PT-2016-5288

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an untrusted information vulnerability...

PT-2016-5287

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue concerns the storage of unspecified passwords in cleartext, allowing local users to obtain sensitive information. Recommendations For versions prior to 9.1.3, update to...

PT-2016-5291

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows remote attackers to gain access via a brute-force approach due to the lack of proper restriction on failed login attempts. Recommendations For versions prior to...

PT-2016-5290

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file. Recommendations For versions prior to 9.1.3, update to version...

CVE-2016-2963: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2016-2937: Improper Input Validation

IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerability."...

PT-2016-5294

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows local users to discover hardcoded credentials. Recommendations For versions prior to 9.1.3, update to version 9.1.3 or later to resolve the issue...

PT-2016-5286

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows remote attackers to cause a denial of service via an invalid HTTP request. Recommendations For versions prior to 9.1.3, update to version 9.1.3 or later to resolve...

CVE-2016-2944: Improper Authentication

IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach...

CVE-2016-2933: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted request...

CVE-2016-2948: Use of Hard-coded Credentials

IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors...

CVE-2016-2934: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2016-5289

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue involves multiple unspecified vulnerabilities that allow remote attackers to obtain sensitive information. The estimated number of potentially affected devices and details...

PT-2016-5298

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue makes it easier for remote attackers to obtain sensitive information by leveraging the use of HTTP, as the HSTS protection mechanism is not enabled. Recommendations For...