IBM Tivoli Business Service Manager vulnerabilities

6 CVEs affecting IBM Tivoli Business Service Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4344, published 2020-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-0286, published 2018-03-09. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote authenticated users to obtain administrator passwords by leveraging…
CVE-2016-0311, published 2018-02-02. Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote attackers to inject arbitrary web…
CVE-2014-3031, published 2014-08-12. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 4.2.0 before 4.2.0.0 IF12 and 4.2.1 before 4.2.1.3 IF9 allows remote authenticated users to inject arbitrary web script…
CVE-2008-0441, published 2008-01-25. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Tivoli Business Service Manager (TBSM) 4.1.1 stores passwords in cleartext (1) after external authentication, which triggers writing the password to SM_server.log; and (2) after a reconfig…
CVE-2007-1940, published 2007-04-11. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Business Service Manager (TBSM) 4.1 before Interim Fix 1 logs passwords in plaintext, which allows local users to obtain sensitive information by reading (1) ncisetup.db or (2) msi.log.
CVE-2020-4344, published 2020-09-15. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247.