IBM Bigfix Inventory vulnerabilities

9 CVEs affecting IBM Bigfix Inventory, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-8964, published 2017-07-13.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-8964, published 2017-07-13. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
• CVE-2016-8980, published 2017-02-01. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to…
• CVE-2016-8962, published 2017-04-26. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851.
• CVE-2016-8966, published 2017-02-01. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this…
• CVE-2016-8977, published 2017-02-01. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system.
• CVE-2016-8961, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could…
• CVE-2016-8981, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system.
• CVE-2016-8963, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.
• CVE-2016-8967, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user.