CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1226
https://notcve.org/view.php?id=CVE-2017-1226
IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) generates an error message in error logs that includes sensitive information about its environment which could be used in further attacks against the system. IBM X-Force ID: 123905. IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 y 9.5) genera un mensaje de error en registros de error que incluye información sensible sobre su entorno que podría emplearse en más ataques contra el sistema. IBM X-Force ID: 123905. • http://www.ibm.com/support/docview.wss?uid=swg22009673 http://www.securityfocus.com/bid/101571 https://exchange.xforce.ibmcloud.com/vulnerabilities/123905 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1521
https://notcve.org/view.php?id=CVE-2017-1521
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129831. IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 y 9.5) es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades planeadas. • http://www.ibm.com/support/docview.wss?uid=swg22009673 http://www.securityfocus.com/bid/101571 https://exchange.xforce.ibmcloud.com/vulnerabilities/129831 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-1227
https://notcve.org/view.php?id=CVE-2017-1227
IBM Tivoli Endpoint Manager could allow a unauthorized user to consume all resources and crash the system. IBM X-Force ID: 123906. IBM Tivoli Endpoint Manager podría permitir a un usuario no autorizado consumir todos los recursos y bloquear el sistema. ID de IBM X-Force: 123906. • http://www.ibm.com/support/docview.wss?uid=swg22003222 https://exchange.xforce.ibmcloud.com/vulnerabilities/123906 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2017-1219
https://notcve.org/view.php?id=CVE-2017-1219
IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 123859. IBM Tivoli Endpoint Manager es vulnerable a un ataque de Inyección XML External Entity (XXE) al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información confidencial o consumir recursos de memoria. • http://www.ibm.com/support/docview.wss?uid=swg22006014 https://exchange.xforce.ibmcloud.com/vulnerabilities/123859 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2017-1203
https://notcve.org/view.php?id=CVE-2017-1203
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123678. La plataforma y las aplicaciones de IBM Tivoli Endpoint Manager (para Lifecycle/Power/Patch) son vulnerables a un problema de tipo cross-site-scripting. Esta vulnerabilidad permite a los usuarios insertar código JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conllevar a la divulgación de credenciales dentro de una sesión de confianza. • http://www.ibm.com/support/docview.wss?uid=swg22005246 http://www.ibm.com/support/docview.wss?uid=swg22006014 http://www.securityfocus.com/bid/99916 https://exchange.xforce.ibmcloud.com/vulnerabilities/123678 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •