CVE-2017-1201

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	BigFix Compliance Analytics	1.9.79

References

http://www.ibm.com/support/docview.wss?uid=swg22008114Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/123676VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008114Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/123676VDB Entry, Vendor Advisory

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-12025.4IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML CVE-2017-12036.1IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability CVE-2017-12049.8IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to g CVE-2017-12058.8IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root acces CVE-2017-120616.1An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the Ma CVE-2017-120626.1An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered CVE-2017-120647.5The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restr CVE-2017-120659.8spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end pa CVE-2017-120665.4Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrar CVE-2017-120677.5Potrace 1.14 has a heap-based buffer over-read in the interpolate_cubic function in mkbitmap.c.CVE-2017-120686.1The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk ac CVE-2017-120698.2An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.0