IBM Bigfix Security Compliance Analytics vulnerabilities

5 CVEs affecting IBM Bigfix Security Compliance Analytics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1201, published 2017-10-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-1196, published 2017-06-07. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID:…
CVE-2017-1197, published 2017-06-15. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672.
CVE-2017-1178, published 2017-06-07. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Endpoint Manager for Security and Compliance 1.9.70 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…
CVE-2017-1179, published 2017-06-08. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. IBM BigFix Compliance Analytics 1.9.79 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 123431.
CVE-2017-1201, published 2017-10-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676.