IBM Tivoli Management Framework vulnerabilities

6 CVEs affecting IBM Tivoli Management Framework, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2330, published 2011-06-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-1220, published 2011-06-02. High severity, CVSS 9.0. EPSS: 62.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote authenticated users to execute arbitrary code via a long opts…
CVE-2002-1011, published 2002-10-04. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Buffer overflow in web server for Tivoli Management Framework (TMF) Endpoint 3.6.x through 3.7.1, before Fixpack 2, allows remote attackers to cause a denial of service or execute arbitrary code via…
CVE-2002-1012, published 2002-10-04. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Buffer overflow in web server for Tivoli Management Framework (TMF) ManagedNode 3.6.x through 3.7.1 allows remote attackers to cause a denial of service or execute arbitrary code via a long HTTP GET…
CVE-2000-1239, published 2000-12-31. High severity, CVSS 9.0. EPSS: 2.1% chance of exploitation in the next 30 days. The HTTP interface of Tivoli Lightweight Client Framework (LCF) in IBM Tivoli Management Framework 3.7.1 sets http_disable to zero at install time, which allows remote authenticated users to bypass…
CVE-2011-2330, published 2011-06-02. High severity, CVSS 9.0. EPSS: 1.8% chance of exploitation in the next 30 days. Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 has an unspecified "built-in account" that is "trivially" accessed, which makes it easier for remote attackers to send…
CVE-2005-2170, published 2005-07-11. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The LCF component (lcfd) in IBM Tivoli Management Framework Endpoint allows remote attackers to cause a denial of service (process exit and connection loss) by connecting to LCF and ending the…