Security Bulletin: TADDM - BIRT viewer allow bypass authorization

Summary TADDM fails to properly check for authorization when allowing a user to view BIRT reports. It is possible to bypass authorization in the application via parameters manipulation in the BIRT reporting URL. Vulnerability Details CVE-2013-2974 BIRT viewer allow bypass authorization Descriptio...

CVE-2013-3018

The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354...

CVE-2013-3023

IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361...

CVE-2013-3023

IBM TADDM (Tivoli Application Dependency Discovery Manager) versions 7.1.2 and 7.2.0 up to 7.2.1.4 are affected by CVE-2013-3023, which could allow remote attackers to obtain Tomcat credentials by sniffing HTTP sessions. The IBM Security Bulletin confirms the vulnerability in the Tomcat interface...

CVE-2013-3023

IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361...

CVE-2013-3018

The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager TADDM 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354. Recent assessment...

CVE-2013-4040

IBM TADDM 7.1.2.x and 7.2.x on UNIX-like systems are vulnerable due to default file permissions (755) on configuration and log files, enabling local users to read sensitive information. The issue stems from weak permissions, potentially impacting confidentiality. IBM's security bulletin notes aff...

CVE-2014-6148

CVE-2014-6148 affects IBM Tivoli Application Dependency Discovery Manager (TADDM) versions 7.2.2.0–7.2.2.2 and earlier 7.2.x series, where rptdesign downloads could bypass authentication, enabling remote authenticated users to obtain sensitive information from the TADDM database via a crafted URL...

CVE-2014-6148

IBM Tivoli Application Dependency Discovery Manager TADDM 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 does not require TADDM authentication for rptdesign downloads, which allows remote authenticated users to obtain sensitive database information via a crafted UR...

CVE-2014-6150

Cross-site scripting XSS vulnerability in IBM Tivoli Application Dependency Discovery Manager TADDM 7.2.1.0 through 7.2.1.6 and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Directory traversal

Directory traversal vulnerability in BIRT-viewer in IBM Tivoli Application Dependency Discovery Manager TADDM 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to read arbitrary files via unspecified vectors...

CVE-2014-6149

CVE-2014-6149 relates to a directory traversal in the BIRT-viewer component embedded in IBM Tivoli Application Dependency Discovery Manager (TADDM). Affected TADDM versions: 7.2.0.0–7.2.0.10, 7.2.1.0–7.2.1.6, and 7.2.2.0–7.2.2.2. The underlying issue allows a remote authenticated user to read arb...

CVE-2013-3004

CVE-2013-3004 is a directory traversal vulnerability embedded in the IBM TADDM BIRT-Report Viewer component. The issue affects IBM TADDM 7.1.x and 7.2.x up to but before 7.2.1.5, where remote authenticated users could read arbitrary files on the server via unspecified vectors. The root cause is i...

CVE-2013-2974

The CVE describes a bypass of authorization in IBM Tivoli Application Dependency Discovery Manager (TADDM) via the BIRT viewer. Affected software: TADDM 7.2.1.x prior to 7.2.1.5 (including 7.2.1.0–7.2.1.4). Root cause: incorrect authorization checks in the BIRT reporting URL allow crafted paramet...

Cross site scripting

Cross-site scripting XSS vulnerability in the Data Management Portal Web User Interface in IBM Tivoli Application Dependency Discovery Manager TADDM 7.2.x before 7.2.1.4 allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors...

CVE-2012-5939

IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x is affected by CVE-2012-5939: a cross-site scripting vulnerability in Welcome.do within the Data Management Portal Web UI that allows remote authenticated users to inject arbitrary script via a crafted URL. Impact includes potentia...