Description
IBM License Metric Tool 9 before 9.1.0.2 and Endpoint Manager for Software Use Analysis 9 before 9.1.0.2 do not send an X-Frame-Options HTTP header in response to requests for the login page, which allows remote attackers to conduct clickjacking attacks via vectors involving a FRAME element.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21701389
Scores
EPSS
0.0098
EPSS Percentile
57.9%
Details
CWE
CWE-20
Status
published
Products (5)
ibm/endpoint_manager_family
9.0.1
ibm/endpoint_manager_family
9.1.0
ibm/license_metric_tool
9.0
ibm/license_metric_tool
9.0.1
ibm/license_metric_tool
9.1.0.1
Published
May 25, 2015
Tracked Since
Feb 18, 2026