Design/Logic Flaw

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element...

Code injection

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

Code injection

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-4774

Cross-site request forgery CSRF vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element...

CVE-2014-8926

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-8927

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-4774

Cross-site request forgery CSRF vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element...

CVE-2014-8926

CVE-2014-8926 affects IBM License Metric Tool (CIT) before 2.7.0.2050 in IBM License Metric Tool v7.2.2, v7.5, and v9; IBM Endpoint Manger for Software Use Analysis v9; and Tivoli Asset Discovery for Distributed v7.2.2 and v7.5. A crafted XML query can cause denial of service via CPU consumption ...

CVE-2014-8927

CVE-2014-8927 affects IBM CIT components prior to 2.7.0.2050 in IBM License Metric Tool (7.2.2, 7.5, 9); IBM Endpoint Manager for Software Use Analysis (v9); and Tivoli Asset Discovery for Distributed (7.2.2, 7.5). Root cause is a vulnerability in the XML handling that allows remote attackers to ...

CVE-2014-4778

CVE-2014-4778 concerns IBM License Metric Tool (LM Tool) v9 and IBM Endpoint Manager for Software Use Analysis v9. The issue: the login page response lacks the X-Frame-Options header, enabling clickjacking through framing of the login page. Connected IBM bulletin confirms this and provides remedi...

CVE-2014-4774

CVE-2014-4774 affects IBM License Metric Tool (LM Tool) v9 and IBM Endpoint Manager for Software Use Analysis v9. The login page is vulnerable to CSRF via framing (FRAME) that can hijack user authentication for affected versions before 9.1.0.2. IBM’s security bulletin and related entries confirm ...

CVE-2014-4778

IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element...

CVE-2014-8926: Undefined Security Weakness

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

CVE-2014-8927: Undefined Security Weakness

Common Inventory Technology CIT before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5 allows remote attackers to cause a denial of service CPU consumption or application crash via a...

PT-2015-3776

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 9.0.0 through 9.1.0.1 IBM Endpoint Manager for Software Use Analysis versions 9.0.0 through 9.1.0.1 Description The issue allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME...

PT-2015-3774

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions prior to 9.1.0.2 IBM Endpoint Manager for Software Use Analysis versions prior to 9.1.0.2 Description A cross-site request forgery CSRF issue exists in the login page, allowing remote attackers to hijack the...

PT-2015-4131

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 7.2.2 through 9 before 2.7.0.2050 Endpoint Manger for Software Use Analysis version 9 Tivoli Asset Discovery for Distributed versions 7.2.2 through 7.5 Description The issue allows remote attackers to cause a...

PT-2015-4130

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions prior to 2.7.0.2050 Endpoint Manger for Software Use Analysis version 9 Tivoli Asset Discovery for Distributed versions 7.2.2 and 7.5 Description The issue allows remote attackers to cause a denial of service,...

CVE-2014-4774: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 allows remote attackers to hijack the authentication of arbitrary users via vectors involving a FRAME element...