CVE-2016-8966

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2016-8980

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

CVE-2016-8981

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system...

Xxe

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

Open redirect

IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site...

Information disclosure

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Design/Logic Flaw

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system...

CVE-2016-8966

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2016-8980

IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources...

CVE-2016-8981

IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system...

CVE-2016-8961

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8961 due to a vulnerability where a user-controlled input specifies a link used in an external redirect. An attacker could lure a user to a crafted site to spoof the displayed URL and redirect to a malicious site,...

CVE-2016-8966

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8966 due to a missing HTTP Strict Transport Security header. The root cause is the improper enablement of HSTS, which could allow a remote attacker to obtain sensitive information via man-in-the-middle techniques....

CVE-2016-8981

CVE-2016-8981 affects IBM License Metric Tool v9.x and IBM BigFix Inventory v9.x. The issue stems from cache-control/header usage that allows web pages containing sensitive information to be cached locally by a browser, potentially readable by other users on the same system. Impact described as a...

CVE-2016-8961

IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site...

CVE-2016-8980

IBM BigFix Inventory v9.x and IBM License Metric Tool v9.x are affected by CVE-2016-8980 due to an XML External Entity (XXE) processing flaw in XML handling, enabling denial of service and potential information disclosure. The remediation is to upgrade to IBM BigFix Inventory/License Metric Tool ...

PT-2017-9900

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9 Description The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, the attacker could exploit this to spoof the...

PT-2017-9912

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9 Description The issue is caused by an XML External Entity Injection XXE error when processing XML data, which can lead to a denial of service. A remote attacker could exploit this to expose highly sensitive...

PT-2017-9904

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information. An attacker could exploit this to obtain sensitive...

PT-2017-9905

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9.2 Description The issue concerns the storage of user credentials in plain text, which can be accessed by a local user. This allows unauthorized individuals to obtain sensitive information. Recommendations For IBM...

PT-2017-9913

Name of the Vulnerable Software and Affected Versions IBM BigFix Inventory version 9 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM BigFix Inventory version 9, consider implementing access controls to...