CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2017-1203
https://notcve.org/view.php?id=CVE-2017-1203
IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123678. La plataforma y las aplicaciones de IBM Tivoli Endpoint Manager (para Lifecycle/Power/Patch) son vulnerables a un problema de tipo cross-site-scripting. Esta vulnerabilidad permite a los usuarios insertar código JavaScript arbitrario en la interfaz de usuario web, lo que altera la funcionalidad prevista que puede conllevar a la divulgación de credenciales dentro de una sesión de confianza. • http://www.ibm.com/support/docview.wss?uid=swg22005246 http://www.ibm.com/support/docview.wss?uid=swg22006014 http://www.securityfocus.com/bid/99916 https://exchange.xforce.ibmcloud.com/vulnerabilities/123678 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1224
https://notcve.org/view.php?id=CVE-2017-1224
IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123903. IBM Tivoli Endpoint Manager usa algoritmos criptográficos más débiles de lo esperado que podrían permitir a un atacante descifrar información altamente confidencial. ID de IBM X-Force: 123903. • http://www.ibm.com/support/docview.wss?uid=swg22005246 http://www.securityfocus.com/bid/99916 https://exchange.xforce.ibmcloud.com/vulnerabilities/123903 • CWE-326: Inadequate Encryption Strength •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-0214
https://notcve.org/view.php?id=CVE-2016-0214
IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file. IBM Tivoli Endpoint Manager podría permitir a un atacante remoto subir archivos arbitrarios. Un atacante remoto podría explotar esta vulnerabilidad para subir archivos maliciosos. • http://www.ibm.com/support/docview.wss?uid=swg21993203 http://www.securityfocus.com/bid/94193 • CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-0396
https://notcve.org/view.php?id=CVE-2016-0396
IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected. IBM Tivoli Endpoint Manager podrían permitir a un usuario en circunstancias especiales inyectar comandos que sería ejecutado con privilegios superiores innecesarios de lo esperado. • http://www.ibm.com/support/docview.wss?uid=swg21993206 http://www.securityfocus.com/bid/94155 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2016-0297
https://notcve.org/view.php?id=CVE-2016-0297
IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques. IBM Tivoli Endpoint Manager - Mobile Device Managemen (MDM) podría permitir a un atacante remoto obtener información sensible debido a un HTTP Strict-Transport-Security Header perdido a través de técnicas man-in-the-middle. • http://www.ibm.com/support/docview.wss?uid=swg21993214 http://www.securityfocus.com/bid/94188 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •