IBM License Metric Tool vulnerabilities

18 CVEs affecting IBM License Metric Tool, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36352, published 2025-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8964, published 2017-07-13. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
CVE-2014-8924, published 2015-05-20. Medium severity, CVSS 6.4. EPSS: 1.8% chance of exploitation in the next 30 days. The server in IBM License Metric Tool 7.2.2 before IF15 and 7.5 before IF24 and Tivoli Asset Discovery for Distributed 7.2.2 before IF15 and 7.5 before IF24 allows remote attackers to read arbitrary…
CVE-2016-8980, published 2017-02-01. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to…
CVE-2015-4929, published 2015-10-11. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive…
CVE-2014-8927, published 2015-05-25. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5…
CVE-2014-8926, published 2015-05-25. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for Distributed 7.2.2 and 7.5…
CVE-2016-8966, published 2017-02-01. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this…
CVE-2016-8977, published 2017-02-01. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system.
CVE-2023-43044, published 2023-09-28. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. IBM License Metric Tool 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view…
CVE-2014-4778, published 2015-05-25. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which…

Latest

CVE-2025-36352, published 2025-09-29. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM License Metric Tool 9.2.0 through 9.2.40 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus…
CVE-2025-36351, published 2025-09-29. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM License Metric Tool 9.2.0 through 9.2.40 could allow an authenticated user to bypass access controls in the REST API interface and perform unauthorized actions.
CVE-2016-8963, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.
CVE-2016-8967, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user.
CVE-2016-8981, published 2017-02-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system.