CVE-2017-1203

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 123678.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	BigFix family	9.1; 9.2; 9.5

References

http://www.ibm.com/support/docview.wss?uid=swg22005246Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006014Vendor Advisory
http://www.securityfocus.com/bid/99916Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/123678VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22005246Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22006014Vendor Advisory
http://www.securityfocus.com/bid/99916Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/123678VDB Entry, Vendor Advisory

Timeline

Published: Jul 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-12049.8IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to g CVE-2017-12058.8IBM Platform LSF 10.1 contains an unspecified vulnerability that could allow a local user to escalate their privileges and obtain root acces CVE-2017-120616.1An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the Ma CVE-2017-120626.1An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered CVE-2017-120647.5The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restr CVE-2017-120659.8spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end pa CVE-2017-120665.4Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrar CVE-2017-120677.5Potrace 1.14 has a heap-based buffer over-read in the interpolate_cubic function in mkbitmap.c.CVE-2017-120686.1The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk ac CVE-2017-120698.2An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server (LDS) before 1.0 CVE-2017-12075.5IBM WebSphere Message Broker stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123777.CVE-2017-120708.8Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.