CVE-2019-4013

CVE-2019-4013 affects IBM BigFix Platform (9.5.x, including 9.5.x prior to 9.5.12; e.g., 9.5.9.62) and is an Arbitrary File Upload vulnerability. A authenticated user can upload arbitrary files to any location on the server with root privileges due to path traversal and insufficient validation, e...

CVE-2016-0296

CVE-2016-0296 concerns IBM Tivoli Endpoint Manager (Mobile Device Management). The available documentation states that log files may contain potentially sensitive information and could be accessible to a local user, implying a local information disclosure affecting confidentiality. The NVD entry ...

CVE-2018-1484

CVE-2018-1484 affects IBM BigFix Platform versions 9.2.0–9.2.14 and 9.5–9.5.9. The root cause is that authorization tokens and session cookies are not marked with the Secure attribute, allowing the cookies to be sent over insecure links. An attacker could obtain cookie values by luring a user to ...

CVE-2019-4061

CVE-2019-4061 affects IBM BigFix Platform 9.2 and 9.5. The vulnerability arises from relay components not requiring authentication, allowing a remote attacker to query the relay and collect information on updates and fixlets deployed to sites. The impact is information disclosure with no user int...

CVE-2018-1474

IBM BigFix Platform is affected by HTTP response splitting (CVE-2018-1474). Affected versions: 9.2.0–9.2.14 and 9.5–9.5.9. Exploitation could inject arbitrary HTTP headers, enabling cache poisoning or cross-site scripting. According to Nessus, remediation is to upgrade to 9.2.15 or 9.5.10. No add...

CVE-2016-0297

CVE-2016-0297 affects IBM Tivoli Endpoint Manager (Mobile Device Management). The root cause is a missing HTTP Strict-Transport-Security header, which could enable man-in-the-middle attackers to obtain sensitive information. The provided documents do not specify affected versions, exploit details...

CVE-2017-1224

CVE-2017-1224 affects IBM Tivoli Endpoint Manager (BigFix) and is described in connected sources as a cryptographic weakness that could allow an attacker to decrypt highly sensitive information. The core issue is the use of weaker-than-expected cryptographic algorithms in Tivoli Endpoint Manager....

CVE-2017-1232

CVE-2017-1232 affects IBM BigFix Platform (formerly IBM Tivoli Endpoint Manager) 9.2.x before 9.2.12 and 9.5.x before 9.5.7. The vulnerability is information disclosure due to transmitting sensitive data in plaintext over a sniffable network channel. Impact is partial confidentiality loss; no int...

CVE-2016-0293

IBM BigFix Platform (formerly Tivoli Endpoint Manager) is affected by a cross-site scripting (XSS) vulnerability in the BESWRPT handling for versions 9.x before 9.1.8 and 9.2.x before 9.2.8. The issue allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file. Sev...

CVE-2017-1219

CVE-2017-1219 describes an XML External Entity (XXE) injection vulnerability in IBM Tivoli Endpoint Manager (now IBM BigFix Platform). The issue arises while processing XML data, allowing a remote attacker to disclose sensitive information or exhaust memory resources. Connected sources consistent...

CVE-2017-1231

CVE-2017-1231 affects IBM BigFix Platform 9.5 (9.5.0 to 9.5.9). The root cause is storing user credentials in plaintext on the server, allowing a local attacker to read them. Public references from NVD/CNVD/Nessus indicate an information-disclosure vulnerability with high impact when exposed loca...

CVE-2016-0269

CVE-2016-0269 affects IBM BigFix Platform/BES Gather component on IBM BigFix Server (9.x). The vulnerability is an XSS in BES Gather or related handling that allows remote (authenticated) attackers to inject arbitrary scripts via crafted URLs. Affected versions include 9.x before 9.1.8 and 9.2.x ...

CVE-2016-0396

The CVE-2016-0396 entry refers to IBM Tivoli Endpoint Manager (aka IBM BigFix Platform/Tivoli Endpoint Manager) with a remote command-injection flaw. Connected sources indicate the issue is in the Web Reports component, allowing an unauthenticated remote attacker to inject commands that execute w...

CVE-2016-6082

CVE-2016-6082 affects IBM BigFix Platform (BigFix BES Root Server/Relay) shipped with IBM License Metric Tool v9.x and BigFix Inventory v9.x. Description and connected sources confirm a remote code execution risk caused by a use-after-free race condition, allowing an unauthenticated remote attack...

CVE-2016-6085

IBM BigFix Platform (BES Root Server and BES Relay) on the local network is affected by a Denial of Service vulnerability (CVE-2016-6085) due to improper handling of unspecified user-supplied input, which could cause the BES and relay servers to crash. Related advisories reference this alongside ...

CVE-2017-1226

CVE-2017-1226 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The vulnerability stems from error logging that may include sensitive environmental information, enabling potential attackers to gather details for follow-on actions. Affected component: error messages l...

CVE-2017-1222

CVE-2017-1222 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The root cause is a missing authentication check on a critical resource or function, allowing anonymous users to access protected areas. Public sources in the connected documents corroborate this: multip...

CVE-2017-1229

IBM BigFix / Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) is affected by CVE-2017-1229 due to failure to enable HTTP Strict Transport Security. This causes potential information disclosure via MITM as described by the vulnerability notes in multiple sources. Root cause: HSTS not properly enab...

CVE-2017-1521

Summary: CVE-2017-1521 affects IBM BigFix Platform (formerly IBM Tivoli Endpoint Manager) Web UI in 9.2.x prior to 9.2.12 or 9.5.x prior to 9.5.7, allowing an attacker to embed arbitrary JavaScript in the Web UI and potentially disclose credentials in a trusted session (cross-site scripting). Aff...

CVE-2017-1218

CVE-2017-1218 affects IBM Tivoli Endpoint Manager (IBM BigFix Platform). The connected sources confirm a cross-site request forgery (CSRF) vulnerability in the web component of Tivoli Endpoint Manager/BigFix, enabling an attacker to perform malicious, unauthorized actions using an authenticated u...

CVE-2017-1220

CVE-2017-1220 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2 and 9.5. The connected documents describe an information disclosure vulnerability where sensitive data is exposed to unauthorized users, enabling potential follow-on attacks. The root cause details are not explicitly...

CVE-2018-1478

CVE-2018-1478 affects IBM BigFix Platform 9.2.0–9.2.14 and 9.5–9.5.9, enabling a remote attacker to hijack a user’s click actions by luring them to a malicious website (clickjacking). Nessus notes fixes in 9.2.15/9.5.10; upgrade affected installations to these versions or newer. Exploitation deta...

CVE-2018-1480

CVE-2018-1480 affects IBM BigFix Platform versions 9.2.0–9.2.14 and 9.5–9.5.9. The root cause is that authorization tokens or session cookies are not marked HttpOnly, which could allow a client-side script to access cookies in the presence of a Cross-Site Scripting vulnerability, enabling potenti...

CVE-2017-1225

CVE-2017-1225 affects IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x before 9.2.12 and 9.5.x before 9.5.7. The issue is information disclosure caused by sensitive data in URL parameters, which can be exposed via server logs, referrer headers, or browser history. Remediation suggeste...

CVE-2016-0295

CVE-2016-0295 affects IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 up to and including 9.5.1, where a Cross-Site Request Forgery (CSRF) vulnerability could allow remote attackers to hijack user sessions and perform requests that insert XSS sequences. Root cause involves CSRF in the platform that en...

CVE-2017-1203

CVE-2017-1203 affects the IBM Tivoli Endpoint Manager (now IBM BigFix Platform) web UI. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of user-supplied input in the Web UI, allowing an attacker to embed arbitrary JavaScript code that could alter functionality...

CVE-2017-1230

CVE-2017-1230 affects the IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.2.x and 9.5.x. The root cause is the use of insufficiently random numbers/values in a security context that depends on unpredictable numbers, enabling potential attackers to guess tokens or identifiers and expose s...

CVE-2018-1473

IBM BigFix Platform versions 9.2 and 9.5 are affected by a cross-site scripting (XSS) vulnerability in the Web UI. The vulnerability allows an attacker to inject arbitrary JavaScript code, potentially altering functionality and leading to credentials disclosure within a trusted session. This info...

CVE-2016-0214

CVE-2016-0214 affects IBM Tivoli Endpoint Manager (BigFix). The vulnerability allows a remote attacker to upload arbitrary files to the affected system, with execution of the uploaded file only possible if a user runs it (phishing needed to trick the user). The OpenVAS entry aggregates this CVE u...

CVE-2017-1223

CVE-2017-1223 refers to an open redirection vulnerability in IBM Tivoli Endpoint Manager (IBM BigFix Platform). A remote attacker can lure a user to a crafted site to spoof the displayed URL and redirect to a malicious site, enabling phishing and potentially exposing sensitive information or enab...

CVE-2017-1227

CVE-2017-1227 concerns IBM Tivoli Endpoint Manager (BigFix/TEM). The NVD entry states that an unauthenticated user could exhaust resources and crash the system (availability impact). CVSSv3 base score 7.5 (HIGH) with NETWORK attack vector, no user interaction, and high impact on availability. In ...

CVE-2017-1228

The CVE-2017-1228 entry concerns IBM Tivoli Endpoint Manager/IBM BigFix Platform 9.2 and 9.5. The issue is an information-disclosure vulnerability caused by failing to properly enable the secure cookie attribute, enabling an attacker to obtain sensitive data via man-in-the-middle techniques. Impa...

CVE-2017-1221

IBM Tivoli Endpoint Manager (IBM BigFix) versions 9.2 and 9.5 have a weakness where the system does not require strong passwords by default, increasing the risk of account compromise. This root cause is described across multiple sources (NVD entry CVE-2017-1221 and related records). Affected comp...

CVE-2018-1476

CVE-2018-1476 affects IBM BigFix Platform 9.2.0–9.2.14 and 9.5–9.5.9, where sensitive information is disclosed to unauthorized users. The NVD entry describes this as an information-disclosure vulnerability that can be used to mount further attacks on the system. The provided documents do not spec...

CVE-2019-4058

CVE-2019-4058 affects IBM BigFix Platform versions 9.2 through 9.5, where a low-privilege user can manipulate the UI to expose interface elements and information normally restricted to administrators. The issue is confirmed across multiple sources (NVD, vendor PT/security pages), with the impact ...

CVE-2016-0291

CVE-2016-0291 affects IBM BigFix Platform versions 9.0, 9.1 prior to 9.1.8, and 9.2 prior to 9.2.8. The issue allows remote authenticated users to execute arbitrary OS commands by leveraging the report server access. The root cause is tied to how the report server handles requests, enabling comma...

CVE-2016-6084

CVE-2016-6084 affects IBM BigFix Platform shipped with IBM Endpoint Manager for Software Use Analysis v2.2. A vulnerability allows an attacker on the local network to crash the BES server by sending a specially crafted XMLSchema request. The IBM security bulletin notes the impact as a crash of th...

CVE-2018-1485

Summary: CVE-2018-1485 affects IBM BigFix Platform. From the sources, versions 9.2.0–9.2.14 and 9.5–9.5.9 do not renew a session variable after successful authentication, enabling session fixation/hijacking via a cookie that may be known to an attacker. Affected software: IBM BigFix Platform (9.2...

CVE-2019-4011

CVE-2019-4011 affects IBM BigFix Platform 9.2 and 9.5, where a cross-site scripting flaw in the Web UI can allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause: XSS in the Web UI. Impact is described as credential exposure; no ex...

CVE-2018-1475

The CVE-2018-1475 entry concerns IBM BigFix Platform versions 9.2 and 9.5 where the relay/diagnostic authentication mechanism uses an inadequate account lockout setting. This configuration could allow a remote attacker to perform brute-force attempts against credentials, potentially compromising ...

CVE-2018-2005

CVE-2018-2005 affects IBM BigFix Platform versions 9.2 and 9.5. The vulnerability is an information disclosure where potentially sensitive data is stored in process memory and could be read by a local attacker with elevated permissions. The issue stems from data stored in memory and is categorize...

CVE-2018-1481

CVE-2018-1481 affects IBM BigFix Platform versions 9.2.0 through 9.2.14 and 9.5 through 9.5.9. The issue arises because sensitive information is stored in URL parameters, which can be exposed if URLs are logged or exposed via referrers or browser history. The provided documents confirm the affect...

CVE-2018-1600

CVE-2018-1600 affects IBM BigFix Platform 9.2 and 9.5, where sensitive or security-critical data is transmitted in clear text over a network channel that can be sniffed by an attacker. The root cause is insecure plain-text transmission within the affected components. Documented impact includes po...

CVE-2018-1479

CVE-2018-1479 affects IBM BigFix Platform 9.2 and 9.5. The vulnerability is a Cross-Site Request Forgery (CSRF) that could allow an attacker to execute malicious, unauthorized actions transmitted from a trusted user’s session. The provided connected documents corroborate the CSRF description, but...