IBM Tivoli Endpoint Manager vulnerabilities

9 CVEs affecting IBM Tivoli Endpoint Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-0718, published 2020-02-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-3066, published 2014-07-02. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference,…
CVE-2014-6137, published 2015-02-16. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2012-4841, published 2012-11-29. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. Unspecified vulnerability in Tivoli Endpoint Manager for Remote Control Broker 8.2 before 8.2.1-TIV-TEMRC821-IF0002 allows remote attackers to cause a denial of service (resource consumption) via…
CVE-2012-1837, published 2012-03-22. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which…
CVE-2012-0719, published 2012-03-22. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Tivoli Endpoint Manager (TEM) 8 before 8.2 patch 3 allows remote attackers to inject arbitrary web script or HTML via the ScheduleParam parameter to…
CVE-2013-0453, published 2013-03-21. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2014-6113, published 2015-02-16. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or HTML via unspecified…
CVE-2012-0718, published 2020-02-18. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies.
CVE-2013-0452, published 2013-03-29. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack the authentication of…