Security Bulletin: Privilege Escalation Vulnerability in the FlashCopy Manager for VMware GUI (CVE-2013-6714)

Summary In customer environments that utilize VMware restricted users, users of the Tivoli Storage FlashCopy Manager: FlashCopy Manager for VMware GUI can back up and restore VMs that they are not authorized to access. Vulnerability Details CVE ID: CVE-2013-6714 DESCRIPTION: In customer...

IBM Tivoli Storage Manager for Virtual Environments: Data Protection for Vmware and Tivoli Storage FlashCopy Manager for Vmware Cross-Site Request Forgery Vulnerabilities

IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware aka Spectrum Protect for Virtual Environments and Tivoli Storage FlashCopy Manager for VMware a.k.a. Spectrum Protect Snapshot are both products of IBM USA. The former is a VM backup and recovery solution. The latter ...

CVE-2016-3059

CVE-2016-3059 affects IBM Tivoli Storage Manager for Databases (IBM Spectrum Protect for Databases) and IBM Tivoli Storage FlashCopy Manager for Microsoft SQL Server (IBM Spectrum Protect Snapshot). The vulnerability allows local users to disclose the cleartext SQL Server password by reading the ...

CVE-2016-3059

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server aka IBM Spectrum Protect for Databases 6.3 before 6.3.1.7 and 6.4 before 6.4.1.9 and Tivoli Storage FlashCopy Manager for Microsoft SQL Server aka IBM Spectrum Protect Snapshot 3.1 before 3.1.1.7 and 3.2 before...

IBM Tivoli Storage FlashCopy Manager for VMware 3.1.x < 3.1.1.3 / 3.2.x < 3.2.0.6 / 4.1.x < 4.1.4.0 Command Execution

The version of IBM Tivoli Storage FlashCopy Manager for VMware installed on the remote host is affected by multiple vulnerabilities : - An unspecified flaw exists in the graphical user interface that allows an unauthenticated, remote attacker to perform backup and restore operations, along with...

IBM Tivoli Storage FlashCopy Manager and Tivoli Storage Manager Local Privilege Vulnerability

IBM Tivoli Storage FlashCopy Manager is a suite of software that provides a high level of data protection for critical applications and databases through integrated snapshot capabilities.Tivoli Storage Manager is a suite of software that automates data protection for e-mail servers. A security...

IBM Tivoli Storage FlashCopy Manager and Tivoli Storage Manager local boost vulnerability (CNVD-2015-08435)

IBM Tivoli Storage FlashCopy Manager is a suite of software that provides a high level of data protection for critical applications and databases through integrated snapshot capabilities.Tivoli Storage Manager is a suite of software that automates data protection for e-mail servers. A security...

IBM Tivoli Storage FlashCopy Manager Installed (Linux)

Binary data tivolistorageflashcopymanagerinstalledlinux.nbin...

IBM Tivoli Storage FlashCopy Manager for VMware 3.1.x < 3.1.1.3 / 3.2.x < 3.2.0.6 / 4.1.x < 4.1.3.0 XSS

The version of IBM Tivoli Storage FlashCopy Manager for VMware installed on the remote host is affected by a cross-site scripting XSS vulnerability, due to improper validation of input before returning it to users. An unauthenticated, remote attacker can exploit this, via a specially crafted link...

Design/Logic Flaw

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception...

CVE-2015-4949

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception...

CVE-2015-6557

The CVE-2015-6557 issue affects IBM Tivoli Storage Manager suites (Databases, Mail, FlashCopy Manager) when application tracing is enabled. It discloses cleartext passwords in trace output or GUI exception messages, allowing a local attacker with access to the system to obtain sensitive credentia...

Authorization

The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service data overwrite or disk consumption via...

CVE-2013-6714

The CVE-2013-6714 issue affects IBM Tivoli Storage FlashCopy Manager for VMware (FlashCopy Manager for VMware) 3.1, 3.2 and 4.1, where the GUI does not properly enforce authorization for backup/restore operations. This can allow local users to access VM data or perform restores that overwrite pro...

CVE-2013-6714

The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations, which allows local users to obtain sensitive VM data or cause a denial of service data overwrite or disk consumption via...

Design/Logic Flaw

The 1 Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the 2 FlashCopy Manager for Exchange component 2.2 and 3.1 before 3.1.1 in IBM Tivoli Storage FlashCopy Manager do not properly constrain mailbox contents during certain...

CVE-2013-3976

IBM’s advisory for CVE-2013-3976 states that Data Protection for Microsoft Exchange (Tivoli Storage Manager for Mail) versions 6.1 and 6.3 and FlashCopy Manager for Microsoft Exchange versions 2.1, 2.2, and 3.1 may misbind contents when restoring multiple mailboxes into PSTs, causing a mailbox ow...

CVE-2013-3976

The 1 Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the 2 FlashCopy Manager for Exchange component 2.2 and 3.1 before 3.1.1 in IBM Tivoli Storage FlashCopy Manager do not properly constrain mailbox contents during certain...