IBM Bigfix Compliance vulnerabilities

4 CVEs affecting IBM Bigfix Compliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1202, published 2019-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1177, published 2019-02-05. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123429.
CVE-2017-1198, published 2019-02-05. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs…
CVE-2017-1202, published 2019-02-05. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's…
CVE-2017-1200, published 2019-02-05. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a…