CVE-2017-1229

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 123908.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	BigFix family	9.2; 9.5

References

http://www.ibm.com/support/docview.wss?uid=swg22005246Issue Tracking, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/123908Issue Tracking, VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22005246Issue Tracking, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/123908Issue Tracking, VDB Entry, Vendor Advisory

Timeline

Published: Nov 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-122906.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122916.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122926.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122938.6A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.CVE-2017-122945.4A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack CVE-2017-122955.3A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the applicatio CVE-2017-122966.1A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attac CVE-2017-122975.0A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to arbitrary hosts, aka CVE-2017-122986.1A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack CVE-2017-122995.3A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Serv CVE-2017-12305.3IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that depend CVE-2017-123005.8A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a