Unscored severity · published May 25, 2015
CVE-2015-1915
The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager Family · Ibm
9.0.1; 9.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1915
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1915
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg1IV72069
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21882571
www.securityfocus.com
http://www.securityfocus.com/bid/74193
More from Endpoint Manager Family
–
CVE-2014-8927
Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for…
–
CVE-2014-8926
Common Inventory Technology (CIT) before 2.7.0.2050 in IBM License Metric Tool 7.2.2, 7.5, and 9; Endpoint Manger for Software Use Analysis 9; and Tivoli Asset Discovery for…
–
CVE-2014-4778
IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the…
–
CVE-2014-4774
Cross-site request forgery (CSRF) vulnerability in the login page in IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2…