IBM Tivoli Storage Manager vulnerabilities

49 vulnerabilities

Known vulnerabilities in IBM Tivoli Storage Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.2MediumCVE-2018-1550ibm · spectrum_protect +3 moreibm spectrum_protectIBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696.EPSS0.29%7.5HighCVE-2018-1786ibm · spectrum_protect +5 moreibm spectrum_protectIBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.EPSS2.43%3.5LowCVE-2003-1570ibm · tivoli_storage_manageribm tivoli_storage_managerThe server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."EPSS1.00%7.2HighCVE-2013-2964ibm · tivoli_storage_manageribm tivoli_storage_managerBuffer overflow in dsmtca in IBM Tivoli Storage Manager (TSM) through 5.5.4.0, 6.1.0 through 6.1.5.4, 6.2.0 through 6.2.4.7, and 6.3.0 through 6.3.0.17 on UNIX and Linux allows local users to gain privileges via unspecified vectors.EPSS0.41%4.3MediumCVE-2013-0471ibm · tivoli_storage_manageribm tivoli_storage_managerThe traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.EPSS2.00%5.1MediumCVE-2013-0472ibm · tivoli_storage_manageribm tivoli_storage_managerThe Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access, and consequently obtain unspecified server access, via unknown vectors.EPSS0.99%2.1LowCVE-2013-5371ibm · tivoli_storage_manageribm tivoli_storage_managerThe client in IBM Tivoli Storage Manager (TSM) 6.3.1 and 6.4.0 on Windows does not preserve permissions of Resilient File System (ReFS) files across backup and restore operations, which allows local users to bypass intended access restrictions via standard filesystem operations.EPSS0.38%3.3LowCVE-2013-6335ibm · tivoli_storage_manageribm tivoli_storage_managerThe Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and restore operations, which allows local users to bypass intended access restrictions via standard filesystem operations.EPSS0.34%5.3MediumCVE-2015-4951ibm · tivoli_storage_manageribm tivoli_storage_managerClient Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.EPSS1.35%7.2HighCVE-2015-4927ibm · tivoli_storage_manageribm tivoli_storage_managerThe Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, which allows local users to gain privileges by writing to a file.EPSS0.39%3.7LowCVE-2015-7408ibm · tivoli_storage_manageribm tivoli_storage_managerThe server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.EPSS0.90%2.5LowCVE-2016-2894ibm · tivoli_storage_manageribm tivoli_storage_managerIBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions.EPSS0.30%5.5MediumCVE-2016-0371ibm corporation · tivoli storage manager +1 moreibm corporation tivoli storage managerThe Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.EPSS0.34%7.8HighCVE-2016-5985ibm corporation · tivoli storage manager +1 moreibm corporation tivoli storage managerThe IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash.EPSS0.42%4.3MediumCVE-2016-6044ibm corporation · tivoli storage manager extended edition +1 moreibm corporation tivoli storage manager extended editionIBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy.EPSS0.59%8.8HighCVE-2016-6045ibm corporation · tivoli storage manager extended edition +1 moreibm corporation tivoli storage manager extended editionIBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.EPSS0.55%7HighCVE-2016-6043ibm corporation · tivoli storage manager extended edition +1 moreibm corporation tivoli storage manager extended editionTivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.EPSS0.23%5.4MediumCVE-2016-6046ibm corporation · tivoli storage manager extended edition +1 moreibm corporation tivoli storage manager extended editionIBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.EPSS0.54%6.5MediumCVE-2016-6110ibm corporation · tivoli storage manager +2 moreibm corporation tivoli storage managerIBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user.EPSS0.33%5.5MediumCVE-2016-8916ibm · tivoli_storage_manageribm tivoli_storage_managerIBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.EPSS0.31%