CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1478
https://notcve.org/view.php?id=CVE-2018-1478
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 140760. IBM BigFix Platform, desde la versión 9.2.0 hasta la 9.2.14 y de la versión 9.5 hasta la 9.5.9, podría permitir que un atacante remoto secuestre la acci... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140760 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1480
https://notcve.org/view.php?id=CVE-2018-1480
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization tokens or session cookies. If a Cross-Site Scripting vulnerability also existed attackers may be able to get the cookie values via malicious JavaScript and then hijack the user session. IBM X-Force ID: 140762. IBM BigFix Platform, desde la versón 9.2.0 hasta la 9.2.14 y desde la versión 9.5 hasta la 9.5.9, no establece el atributo "HttpOnly" en los tokens de autorización o en las cookies de ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140762 • CWE-384: Session Fixation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1481
https://notcve.org/view.php?id=CVE-2018-1481
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763. IBM BigFix Platform, de la versión 9.2.0 hasta la 9.2.14 y desde la versión 9.5 hasta la 9.5.9, almacena información sensible en parámetros de la URL. Esto podría llevar a una divulgación de información si partes no autorizadas tienen a... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140763 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1484
https://notcve.org/view.php?id=CVE-2018-1484
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 140969. IBM BigFix Platform, desde la versión 9.2.0 hasta la 9.2.14 y de la versión 9.5 hasta la 9.... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140969 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1485
https://notcve.org/view.php?id=CVE-2018-1485
12 Dec 2018 — IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not renew a session variable after a successful authentication which could lead to session fixation/hijacking vulnerability. This could force a user to utilize a cookie that may be known to an attacker. IBM X-Force ID: 140970. IBM BigFix Platform, desde la versión 9.2.0 hasta la 9.2.14 y desde la versión 9.5 hasta la 9.5.9, no renueva una variable de sesión tras una autenticación exitosa. Esto podría desembocar en una vulnerabilidad de fija... • https://exchange.xforce.ibmcloud.com/vulnerabilities/140970 • CWE-384: Session Fixation •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1600
https://notcve.org/view.php?id=CVE-2018-1600
04 Jun 2018 — IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized actors. IBM X-Force ID: 143745. IBM BigFix Platform 9.2 y 9.5 transmite datos sensibles o críticos para la seguridad en texto claro en un canal de comunicación que puede ser rastreado por actores no autorizados. IBM X-Force ID: 143745. • http://www.ibm.com/support/docview.wss?uid=swg22015754 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1479
https://notcve.org/view.php?id=CVE-2018-1479
27 Apr 2018 — IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 140761. IBM BigFix Platform 9.2 y 9.5 es vulnerable a ataques de Cross-Site Request Forgery (CSRF). Esto podría permitir que un atacante ejecute acciones maliciosas y no autorizadas transmitidas desde un usuario en el que la web confía. IBM X-Force ID: 140761. • http://www.ibm.com/support/docview.wss?uid=swg22015754 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1473
https://notcve.org/view.php?id=CVE-2018-1473
27 Apr 2018 — IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140691. IBM BigFix Platform 9.2 y 9.5 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades prevista... • http://www.ibm.com/support/docview.wss?uid=swg22015754 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1475
https://notcve.org/view.php?id=CVE-2018-1475
27 Apr 2018 — IBM BigFix Platform 9.2 and 9.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 140756. IBM BigFix Platform 9.2 y 9.5 emplea una configuración de bloqueo de cuenta inadecuada que podría permitir que un atacante remoto descifre credenciales de cuenta por fuerza bruta. IBM X-Force ID: 140756. • http://www.ibm.com/support/docview.wss?uid=swg22015754 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-0295
https://notcve.org/view.php?id=CVE-2016-0295
28 Feb 2018 — Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en IBM BigFix Platform 9.0, 9.1, 9.2 y versiones 9.5 anteriores a la 9.5.2 permite que atacantes remotos secuestren la autenticación de usuarios arbitrarios para peticiones que inserten secuencias XSS. IBM X-Force... • http://www-01.ibm.com/support/docview.wss?uid=swg21985830 • CWE-352: Cross-Site Request Forgery (CSRF) •