CVE-2016-6043

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced...

CVE-2016-6044

IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...

CVE-2016-6045

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-6046

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-5985

The IBM Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash...

CVE-2016-6034

IBM Tivoli Storage Manager for Virtual Environments VMware could disclose the Windows domain credentials to a user with a high level of privileges...

Buffer overflow

The IBM Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash...

Design/Logic Flaw

IBM Tivoli Storage Manager for Virtual Environments VMware could disclose the Windows domain credentials to a user with a high level of privileges...

Design/Logic Flaw

IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...

Cross site scripting

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross site request forgery (csrf)

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Design/Logic Flaw

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced...

CVE-2016-6045

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-6043

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced...

CVE-2016-6034

IBM Tivoli Storage Manager for Virtual Environments VMware could disclose the Windows domain credentials to a user with a high level of privileges...

CVE-2016-6034

CVE-2016-6034 affects IBM Tivoli Storage Manager for Virtual Environments (Data Protection for VMware / IBM Spectrum Protect for Virtual Environments). The IBM security bulletin documents a vulnerability in the VMware vSphere GUI that could allow a user with high privileges to disclose Windows do...

CVE-2016-6044

Summary: CVE-2016-6044 affects IBM Tivoli Storage Manager Operations Center and allows an authenticated user to enable/disable the REST API, potentially violating security policy. Affected versions: 7.1.0.000–7.1.7.000 and 6.4.1.000–6.4.2.400. Root cause/impact: REST API control vulnerability cou...

CVE-2016-6043

The CVE-2016-6043 issue affects IBM Spectrum Protect Operations Center (TSM/OCenter). It arises from session expiration not being enforced, enabling a local user to take over a previously logged-in user account (session hijack). Affected versions are 7.1.0.000–7.1.7.000 and 6.4.1.000–6.4.2.400. R...

CVE-2016-6044

IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...

CVE-2016-5985

The IBM Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash...