Design/Logic Flaw

IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...

Cross site request forgery (csrf)

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

Cross site scripting

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Design/Logic Flaw

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced...

CVE-2016-5985

CVE-2016-5985 : The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled, allowing a local attacker to execute arbitrary code or cause a system crash. Affected on AIX: 7.1.0.0–7.1.6.2; 6.4.0.0–6.4.3.3; 6.3.0.0–6.3.2.5...

CVE-2016-5985

The IBM Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker could overflow a buffer and execute arbitrary code on the system or cause a system crash...

CVE-2016-6034

IBM Tivoli Storage Manager for Virtual Environments VMware could disclose the Windows domain credentials to a user with a high level of privileges...

CVE-2016-6043

Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced...

CVE-2016-6044

Summary: CVE-2016-6044 affects IBM Tivoli Storage Manager Operations Center and allows an authenticated user to enable/disable the REST API, potentially violating security policy. Affected versions: 7.1.0.000–7.1.7.000 and 6.4.1.000–6.4.2.400. Root cause/impact: REST API control vulnerability cou...

CVE-2016-6034

CVE-2016-6034 affects IBM Tivoli Storage Manager for Virtual Environments (Data Protection for VMware / IBM Spectrum Protect for Virtual Environments). The IBM security bulletin documents a vulnerability in the VMware vSphere GUI that could allow a user with high privileges to disclose Windows do...

CVE-2016-6043

The CVE-2016-6043 issue affects IBM Spectrum Protect Operations Center (TSM/OCenter). It arises from session expiration not being enforced, enabling a local user to take over a previously logged-in user account (session hijack). Affected versions are 7.1.0.000–7.1.7.000 and 6.4.1.000–6.4.2.400. R...

CVE-2016-6045

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2016-6044

IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy...

CVE-2016-0371: Undefined Security Weakness

The Tivoli Storage Manager TSM password may be displayed in plain text via application trace output while application tracing is enabled...

PT-2017-8866

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager Operations Center affected versions not specified Description The issue allows an authenticated attacker to enable or disable the application's REST API, potentially violating security policy. Recommendations At the...

PT-2017-8865

Name of the Vulnerable Software and Affected Versions Tivoli Storage Manager Operations Center affected versions not specified Description The issue allows a local user to take over a previously logged in user due to session expiration not being enforced. Recommendations At the moment, there is n...

CVE-2016-6034: Exposure of Sensitive Information to an Unauthorized Actor

IBM Tivoli Storage Manager for Virtual Environments VMware could disclose the Windows domain credentials to a user with a high level of privileges...

CVE-2016-6046: Improper Neutralization of Input During Web Page Generation

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-6045: Cross-Site Request Forgery (CSRF)

IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

PT-2017-8867

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager Operations Center affected versions not specified Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting a cross-site request forgery weakness. This could happen when the...