CVE-2025-3357 — Improper Validation of Specified Index, Position, or Offset in Input in IBM Tivoli Monitoring

CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input CWE-129 — Improper Validation of Array Index CWE-476 — NULL Pointer Dereference4 documents4 sources

Severity

9.8CRITICALNVD

EPSS

0.9%

top 23.66%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Tivoli Monitoring

Timeline

PublishedMay 28

Description

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code due to improper validation of an index value of a dynamically allocated array.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5ibm/tivoli_monitoring6.3.0.7 — 6.3.0.7 SP15

▶NVDibm/tivoli_monitoring6.3.0.7

🔴Vulnerability Details

GHSA

GHSA-f5w7-cjpw-qq45: IBM Tivoli Monitoring 6↗2025-05-28

▶

CVEList

IBM Tivoli Monitoring code execution↗2025-05-28

▶

📋Vendor Advisories

Microsoft

A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.↗2023-06-13

▶