Security Bulletin: Security vulnerability has been identified in BigFix Platform shipped with IBM License Metric Tool.

Summary BigFix Platform is shipped with IBM License Metric Tool. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2020-4095 DESCRIPTION: HCL BigFix Platform could allow a local authenticated attacker t...

Security Bulletin: Security vulnerabilities have been identified in BigFix Platform shipped with IBM License Metric Tool.

Summary BigFix Platform is shipped with IBM License Metric Tool. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-11358 DESCRIPTION: jQuery, as used in Drupal core, is vulnerable to cross-site...

HCL BigFix Platform Credentials Plaintext Storage Vulnerability

HCL BigFix Platform is a suite of endpoint security management platform from HCL India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL BigFix Platform that stems from the program storing credentials in...

CVE-2020-4104

HCL BigFix WebUI is vulnerable to stored cross-site scripting XSS within the Apps-Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in...

Cross site scripting

HCL BigFix WebUI is vulnerable to stored cross-site scripting XSS within the Apps-Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in...

CVE-2020-4104

HCL BigFix WebUI is vulnerable to stored cross-site scripting XSS within the Apps-Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in...

CVE-2020-4104

CVE-2020-4104 affects HCL BigFix WebUI (Apps->Software module). The vulnerability is a stored XSS flaw caused by lack of proper validation of client data in the web application, allowing an attacker to deliver malicious scripts to authenticated users and execute client-side code. Impact is des...

CVE-2020-4095

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of lea...

CVE-2020-4095

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of lea...

Design/Logic Flaw

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of lea...

CVE-2020-4095

BigFix Platform stores credentials in clear text in system memory, enabling a local attacker with privileges to dump memory and extract credentials for pivoting. Affected: BigFix Platform (IBM/HCL), consistent across CVE-2020-4095 sources (NVD/NVD listing, Red Hat advisory, CNVD, PRION/Design-Log...

CVE-2020-4095

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of lea...

Security Bulletin: Security vulnerabilities have been identified in BigFix Platform shipped with IBM License Metric Tool.

Summary BigFix Platform is shipped with IBM License Metric Tool. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-17498 DESCRIPTION: libssh2 is vulnerable to a denial of service, caused by an...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-16779).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-16779 DESCRIPTION: RubyGem excon could allow a remote attacker to obtain sensitive information, caused by a race condition around persistent connections. By sending a...

CVE-2019-4301

BigFix Self-Service Application SSA is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML...

CVE-2019-4301

BigFix Self-Service Application SSA is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML...

CVE-2019-4301

CVE-2019-4301 affects the BigFix Self-Service Application (SSA). The issue allows arbitrary code execution triggered by Javascript embedded in Running Message or Post Message HTML. The vulnerability is documented with CVSSv3.1 base score 8.4 (HIGH) and CVSSv2 base score 6.0 (MEDIUM). Exploitation...

CVE-2019-4301

BigFix Self-Service Application SSA is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML...

Security Bulletin: Security vulnerabilities have been identified in BigFix Platform shipped with IBM License Metric Tool.

Summary BigFix Platform is shipped with IBM License Metric Tool. Information about a security vulnerability affecting BigFix Platform has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-3855 DESCRIPTION: libssh2 could allow a remote attacker to execute arbitrary code ...

IBM Bigfix Platform Arbitrary File Upload (CVE-2019-4013)

An Arbitrary File Upload vulnerability exists in IBM Bigfix Platform. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...