Bigfix Inventory
Vendor:
First CVE: Feb 1, 2017 · Active for 9 years
9
Total CVEs
More Total CVEs than 88% of tracked products
9.0
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
6.4
Avg CVSS
Higher Avg CVSS than 31% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Bigfix Inventory over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 1, 2017
9 years ago
Most Recent CVE
Jul 13, 2017
3,301 days ago
CVE Severity & Scoring
Bigfix Inventory9 CVEs
78%
11%
11%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local3 (33.3%)
Network6 (66.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (77.8%)
High2 (22.2%)
Unknown0 (0.0%)
User Interaction
None8 (88.9%)
Unknown0 (0.0%)
Required1 (11.1%)
Privileges Required
Low4 (44.4%)
High0 (0.0%)
None5 (55.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-8980HIGH IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this | Feb 1, 2017 | 8.1 | 25 | NO | NO |
CVE-2016-8964CRITICAL IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853. | Jul 13, 2017 | 9.8 | 24 | NO | NO |
CVE-2016-8962MEDIUM IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 11885 | Apr 26, 2017 | 5.9 | 22 | NO | NO |
CVE-2016-8966MEDIUM IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could ex | Feb 1, 2017 | 5.9 | 22 | NO | NO |
CVE-2016-8961MEDIUM IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a re | Feb 1, 2017 | 6.1 | 21 | NO | NO |
CVE-2016-8977MEDIUM IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the sy | Feb 1, 2017 | 5.3 | 20 | NO | NO |
CVE-2016-8963MEDIUM IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user. | Feb 1, 2017 | 5.5 | 20 | NO | NO |
CVE-2016-8967MEDIUM IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user. | Feb 1, 2017 | 5.5 | 16 | NO | NO |
CVE-2016-8981MEDIUM IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system. | Feb 1, 2017 | 5.5 | 16 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Bigfix Inventory
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.2 | 5 | 6.1 | 0.9% | 0 | 0 |