CVE-2016-2930

IBM BigFix Remote Control 9.1.3 is affected by an authentication bypass vulnerability (CVE-2016-2930) that allows a remote attacker to perform actions reserved for an administrator without authentication. Connected sources also reference a fixed version 9.1.4 as the remediation path. Affected com...

CVE-2015-4954

CVE-2015-4954 affects IBM BigFix Remote Control prior to the Interim Fix pack 9.1.2-TIV-IBRC912-IF0001, where the product improperly allows self-signed certificates. This certificate handling weakness could enable remote attackers to perform spoofing attacks via unspecified vectors. The vulnerabi...

CVE-2016-2949

IBM BigFix Remote Control prior to version 9.1.3 has an information disclosure flaw that allows a local attacker to obtain sensitive data by reading cached web pages from another user’s session. Some sources cite affected versions as up to 9.1.2 (CNVD) or generally before 9.1.3 (NVD). The root ca...

CVE-2016-2927

IBM BigFix Remote Control before 9.1.3 is affected: it does not properly restrict the set of available encryption algorithms, enabling remote attackers to defeat cryptographic protections by sniffing the network and performing calculations on encrypted data. The issue is described across multiple...

CVE-2017-1233

Summary : CVE-2017-1233 affects IBM Remote Control. Multiple sources confirm a local privilege escalation in IBM Remote Control v9 (and specifically noting v9.1.4 in CNVD) where a local user could manipulate files to which they lack write access, causing them to be executed with Local System/root...

CVE-2016-2952

IBM BigFix Remote Control is affected by CVE-2016-2952. Versions before 9.1.3 do not enable HSTS, enabling information disclosure via HTTP and allowing remote attackers to obtain sensitive data. The CNVD/NVD entries corroborate an information‑disclosure impact due to missing HSTS. Root cause: HST...

CVE-2016-2929

IBM BigFix Remote Control before 9.1.3 is vulnerable due to a weak default password policy that does not properly restrict password choices, enabling easier brute-force access for remote attackers. The issue affects IBM BigFix Remote Control components implementing authentication and password han...

CVE-2016-2943

IBM BigFix Remote Control before 9.1.3 is affected by CVE-2016-2943: a local information-disclosure vulnerability where an attacker can read a log file to obtain sensitive information due to unspecified privileges. The issue is documented across multiple sources (NVD entry for CVE-2016-2943 and N...

CVE-2016-2928

CVE-2016-2928 affects IBM BigFix Remote Control prior to 9.1.3. An information disclosure exists where a remote authenticated user can obtain sensitive data by reading error logs. This is supported by multiple sources in connected documents (NVD entry and CNVD/OpenVAS entries listing the same vul...

CVE-2016-2932

IBM BigFix Remote Control before 9.1.3 is affected by an XML injection vulnerability (CVE-2016-2932) due to an unspecified flaw that allows an unauthenticated, remote attacker to inject arbitrary XML content. Public documents do not provide exploitation details; one source suggests upgrading to 9...

CVE-2016-2933

CVE-2016-2933 : Directory traversal in IBM BigFix Remote Control before 9.1.3 lets remote authenticated administrators read arbitrary files via a crafted request. Affected product: IBM BigFix Remote Control; vulnerable component: web service/file handling that processes crafted requests; root cau...

CVE-2016-2937

IBM BigFix Remote Control vulnerability (CVE-2016-2937) affects IBM BigFix Remote Control prior to 9.1.3. The issue allows remote attackers to obtain sensitive information or spoof email transmission by sending a crafted POST request, described as an “untrusted information vulnerability.” Affecte...

CVE-2016-2934

IBM BigFix Remote Control is affected by CVE-2016-2934: an XSS vulnerability in versions before 9.1.3 that allows an unauthenticated attacker to inject arbitrary web script/HTML via unspecified vectors in the web interface. Remediation: upgrade to 9.1.3 or later to mitigate.

CVE-2016-2944

IBM BigFix Remote Control before 9.1.3 is affected by an authentication flaw: it does not properly restrict failed login attempts, enabling brute-force access by a remote attacker. Connected sources confirm this vulnerability exists in versions up to 9.1.2 and describe the root cause as insuffici...

CVE-2016-2936

IBM BigFix Remote Control (before 9.1.3) stores passwords in clear text, enabling local users to obtain sensitive credentials. Affected versions include 9.1.2 and earlier. Root cause: cleartext password storage. Impact: information disclosure to local attackers. Remediation: upgrade to version 9....

CVE-2015-4953

CVE-2015-4953 concerns IBM BigFix Remote Control prior to Interim Fix pack 9.1.2-TIV-IBRC912-IF0001. The weakness in its encryption protocol can enable a man-in-the-middle attacker to decrypt traffic. Affected product/component: IBM BigFix Remote Control; root cause is encryption protocol weaknes...

CVE-2016-2935

CVE-2016-2935 affects IBM BigFix Remote Control broker prior to 9.1.3, where an unauthenticated remote actor can cause a denial-of-service by sending an invalid HTTP request. This is corroborated by multiple sources in the connected documents (NVD/NESSUS/CNVD), which list the affected product and...

CVE-2016-2940

IBM BigFix Remote Control is affected by an information-disclosure vulnerability (CVE-2016-2940) present in 9.1.2 and earlier versions, with impact described as a remote attacker obtaining sensitive information. The connected CNVD entry explicitly notes the affected versions (9.1.2 and earlier) a...

CVE-2016-2948

IBM BigFix Remote Control (before 9.1.3) is affected by CVE-2016-2948: a local information-disclosure vulnerability where hardcoded credentials can be discovered by a local attacker via unspecified vectors. Affected version range includes 9.1.2 and earlier; impact is local confidentiality and int...

CVE-2016-2950

CVE-2016-2950 affects IBM BigFix Remote Control prior to 9.1.3. The vulnerability is a SQL injection flaw that allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. IBM BigFix Remote Control versions before 9.1.3 are vulnerable; upgrading to 9.1.3 or applyin...

CVE-2016-2951

CVE-2016-2951 affects IBM BigFix Remote Control prior to 9.1.3. The issue stems from not properly setting the default encryption strength, allowing remote attackers to defeat cryptographic protections by sniffing the network and performing calculations on encrypted data. Affected version: before ...

CVE-2016-2931

IBM BigFix Remote Control is affected by CVE-2016-2931: versions before 9.1.3 allow unauthenticated remote attackers to obtain sensitive cleartext information by sniffing network traffic. Affected product: IBM BigFix Remote Control prior to 9.1.3. Root cause: information disclosure through networ...

CVE-2016-2963

IBM BigFix Remote Control is affected by a CSRF vulnerability (CVE-2016-2963) affecting versions up to 9.1.3 (earlier listings also cite 9.1.2 and older). The issue allows an attacker to hijack the authenticated user’s session by issuing requests that insert XSS sequences, enabling cross-site req...