EUVD-2014-3852

Malware in sbrugna...

CVE-2014-3914: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager TSM in Rocket ServerGraph 1.2 allows remote attackers to 1 create arbitrary files via a .. dot dot in the query parameter in a writeDataFile action to the fileRequestor servlet, execute arbitrary files via a .. dot d...

Command injection

The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a 1 auth, 2 authsession, 3 authsimple, 4 add, 5 addflat, 6 remove, 7 setpwd, 8 addpermissions, 9 revokepermissions, 10 runAsync, or 11 tsmRequest...

CVE-2014-3915: Improper Control of Generation of Code

The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a 1 auth, 2 authsession, 3 authsimple, 4 add, 5 addflat, 6 remove, 7 setpwd, 8 addpermissions, 9 revokepermissions, 10 runAsync, or 11 tsmRequest...