Ibm Tivoli Storage Manager vulnerabilities

CVE-2011-1222 [HIGH] CWE-119 CVE-2011-1222: Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows and AIX allows local users to gain privileges via unspecified vectors.

CVE-2011-1223 [HIGH] CWE-119 CVE-2011-1223: Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-a Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors.

CVE-2015-4927 [HIGH] CWE-264 CVE-2015-4927: The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, which allows local users to gain privileges by writing to a file.

CVE-2017-1301 [MEDIUM] CWE-59 CVE-2017-1301: IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectr IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary

CVE-2016-6043 [HIGH] CWE-384 CVE-2016-6043: Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged i Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced.

CVE-2006-6309 [HIGH] CVE-2006-6309: Multiple array index errors in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 Multiple array index errors in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to read arbitrary memory locations and cause a denial of service (crash) via a large index value in unspecified messages, a different issue than CVE-2006-5855.

CVE-2016-6110 [MEDIUM] CWE-255 CVE-2016-6110: IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be o IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user.

CVE-2015-4951 [MEDIUM] CWE-20 CVE-2015-4951: Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.

CVE-2016-8939 [MEDIUM] CWE-200 CVE-2016-8939: IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password informat IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790.

CVE-2016-8916 [MEDIUM] CWE-200 CVE-2016-8916: IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that coul IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.

CVE-2016-6046 [MEDIUM] CWE-79 CVE-2016-6046: IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerabili IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2013-0472 [MEDIUM] CVE-2013-0472: The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4. The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access, and consequently obtain unspecified server access, via unknown vectors.

CVE-2010-4605 [MEDIUM] CVE-2010-4605: Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x bef Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows local users to overwrite arbitrary files via unknown vectors.

CVE-2016-0371 [MEDIUM] CVE-2016-0371: The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace outpu The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.

CVE-2014-4813 [MEDIUM] CWE-362 CVE-2014-4813: Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6, 5.5.0.0 th Race condition in the client in IBM Tivoli Storage Manager (TSM) 5.4.0.0 through 5.4.3.6, 5.5.0.0 through 5.5.4.3, 6.1.0.0 through 6.1.5.6, 6.2 before 6.2.5.4, 6.3 before 6.3.2.3, 6.4 before 6.4.2.1, and 7.1 before 7.1.1 on UNIX and Linux allows local users to obtain root privileges via unspecified vectors.

CVE-2016-6044 [MEDIUM] CWE-284 CVE-2016-6044: IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disa IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy.

CVE-2013-0471 [MEDIUM] CVE-2013-0471: The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 befo The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.

CVE-2018-1550 [MEDIUM] CWE-269 CVE-2018-1550: IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive info IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696.

CVE-2004-2762 [MEDIUM] CVE-2004-2762: The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5. The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial of service (daemon crash or hang) via unspecified HTTP traffic, as demonstrated by

CVE-2017-1339 [MEDIUM] CWE-327 CVE-2017-1339: IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for t IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or administrator password which can result in information disclosure or a denial of service. IBM X-Force ID: 126247.