Security Bulletin: Vulnerability in password strength policy affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8962)

Summary IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x does not require strong passwords by default, which makes it easier for attackers to compromise user accounts. Vulnerability Details CVEID: CVE-2016-8962 DESCRIPTION: IBM BigFix Inventory v9.x does not require that users should ha...

Security Bulletin: Vulnerability in URL Redirection affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8961)

Summary IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. This simplifies phishing attacks. Vulnerability Details CVEID: CVE-2016-8961 DESCRIPTION: IBM BigFix Inventory v9.x could...

Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-2098 CVE-2016-2097)

Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9 and IBM BigFix Inventory v9. Vulnerability Details CVEID: CVE-2016-2098 DESCRIPTION: Ruby on Rails could allow a remote attacker to execute arbitrary code on the system, caused by improper validation o...

Security Bulletin: An unspecified vulnerability related to the Java SE JCE component affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2017-10115)

Summary There were multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool LMT and IBM BigFix Inventory BFI. These issues were disclosed as part of the IBM Java SDK updates in July 2017. Fixes are already included in LMT and BFI version 9.2.9 or...

Security Bulletin: A security vulnerability has been identified in BigFix Platform shipped with IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-6082)

Summary BigFix Platform BES Root Server and BES Relay is shipped as a component of IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2016-6082...

Security Bulletin: Vulnerability due to a missing HTTP Strict Transport Security header affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x (CVE-2016-8966)

Summary Due to a missing HTTP Strict Transport Security header an unaware user can navigate by mistake to the unencrypted version of the web application or accept invalid certificates. This leads to sensitive data being sent unencrypted over the wire. Vulnerability Details CVEID: CVE-2016-8966...

Security Bulletin: Vulnerability in RubyGems rest-client affects IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis (CVE-2015-1820)

Summary RubyGems rest-client component vulnerability allows for hijacking user session. Vulnerability Details CVE-ID: CVE-2015-1820 Description: RubyGems rest-client could allow a remote attacker to hijack a valid user''s session, caused by Set-Cookie headers being present in an HTTP 30x...

Security Bulletin: Vulnerability due to Server log files exposure affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8963)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 Server log files can potentially reveal sensitive information. Vulnerability Details CVEID: CVE-2016-8963 DESCRIPTION: IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool, IBM Tivoli Asset Discovery for Distributed and IBM Endpoint Manager for Software Use Analysis (April 2015 CPU)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition that is used by IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed.These issues were disclosed as part of the IBM Java SDK updates in April 2015. This bulletin also addresses FREAK: Factoring Attack ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9 and IBM BigFix Inventory v9

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool and IBM BigFix Inventory. These issues were disclosed as part of the IBM Java SDK updates in Jan 2017 Vulnerability Details CVEID: CVE-2016-2183 DESCRIPTION: OpenSSL could...

Security Bulletin: Vulnerability in password storage scheme affects IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-8967)

Summary IBM License Metric Tool v9 and IBM BigFix Inventory v9 stores passwords in plain text. Vulnerability Details CVEID: CVE-2016-8967 DESCRIPTION: IBM BigFix Inventory v9 stores user credentials in plain in clear text which can be read by a local user. CVSS Base Score: 6.2 CVSS Temporal Score...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9, v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed v7.5 & v7.2.2 and IBM Endpoint Manager for Software Use Analysis v9 - CVE-2014-6593, CVE-2015-0400, C

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM License Metric Tool v9, v7.5 & v7.2.2, IBM Tivoli Asset Discovery for Distributed v7.5 & v7.2.2 and IBM Endpoint Manager for Software Use Analysis v9. These issues were disclosed as part of the IBM...

Security Bulletin: IBM License Metric Tool v9 and IBM Endpoint Manager for Software Use Analysis v9 vulnerable to CSRF attacks - CVE-2014-4774, CVE-2014-4778

Summary IBM License Metric Tool v9 and IBM Endpoint Manager for Software Use Analysis v9 are vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed...

Fedora: Security Advisory for git-time-metric (FEDORA-2022-5ef0bd9a27)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for git-time-metric (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: git-time-metric-1.3.5-15.fc36

Simple, seamless, lightweight time tracking for Git...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9.

Summary IBM DB2 is shipped with IBM License Metric Tool. Information about a security vulnerabilities affecting IBM DB2 has been published in a separated security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

Malicious code in metric-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66806e22a1f590ee26637d60921fc3bf8dae035e72a8042a2fde3ae002e2f8de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4576 Malicious code in metric-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66806e22a1f590ee26637d60921fc3bf8dae035e72a8042a2fde3ae002e2f8de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sfdc-metric-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 271cc52be037d1280f7b1e42cb5e7eb1e8638a6d921a2b20713a01b8fbf48041 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...