CVE-2016-2951

IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data...

CVE-2016-2934

IBM BigFix Remote Control is affected by CVE-2016-2934: an XSS vulnerability in versions before 9.1.3 that allows an unauthenticated attacker to inject arbitrary web script/HTML via unspecified vectors in the web interface. Remediation: upgrade to 9.1.3 or later to mitigate.

CVE-2016-2940

IBM BigFix Remote Control is affected by an information-disclosure vulnerability (CVE-2016-2940) present in 9.1.2 and earlier versions, with impact described as a remote attacker obtaining sensitive information. The connected CNVD entry explicitly notes the affected versions (9.1.2 and earlier) a...

CVE-2016-2931

IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network...

CVE-2016-2963

Cross-site request forgery CSRF vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

PT-2016-5286

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows remote attackers to cause a denial of service via an invalid HTTP request. Recommendations For versions prior to 9.1.3, update to version 9.1.3 or later to resolve...

PT-2016-5294

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows local users to discover hardcoded credentials. Recommendations For versions prior to 9.1.3, update to version 9.1.3 or later to resolve the issue...

CVE-2016-2949: Exposure of Sensitive Information to an Unauthorized Actor

IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session...

PT-2016-5298

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue makes it easier for remote attackers to obtain sensitive information by leveraging the use of HTTP, as the HSTS protection mechanism is not enabled. Recommendations For...

CVE-2016-2931: Exposure of Sensitive Information to an Unauthorized Actor

IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network...

PT-2016-5287

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue concerns the storage of unspecified passwords in cleartext, allowing local users to obtain sensitive information. Recommendations For versions prior to 9.1.3, update to...

PT-2016-5284

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description A directory traversal issue allows remote authenticated administrators to read arbitrary files by sending a crafted request. Recommendations For versions prior to 9.1.3, update to...

CVE-2016-2943: Insertion of Sensitive Information into Log File

IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file...

CVE-2016-2951: Undefined Security Weakness

IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and performing calculations on encrypted data...

CVE-2016-2932: XML Injection (aka Blind XPath Injection)

IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors...

CVE-2016-2944: Improper Authentication

IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach...

PT-2016-5307

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. Recommendations For versions...

PT-2016-5291

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows remote attackers to gain access via a brute-force approach due to the lack of proper restriction on failed login attempts. Recommendations For versions prior to...

PT-2016-5290

Name of the Vulnerable Software and Affected Versions IBM BigFix Remote Control versions prior to 9.1.3 Description The issue allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file. Recommendations For versions prior to 9.1.3, update to version...

CVE-2016-2937: Improper Input Validation

IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerability."...