IBM Tivoli Storage Manager vulnerabilities

49 CVEs affecting IBM Tivoli Storage Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-28198, published 2021-05-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-3853, published 2009-11-04. High severity, CVSS 9.3. EPSS: 36.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in the client acceptor daemon (CAD) scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7, 5.4 before 5.4.3, 5.5 before 5.5.2.2, and 6.1 before…
CVE-2008-4563, published 2009-03-11. High severity, CVSS 10.0. EPSS: 29% chance of exploitation in the next 30 days. Heap-based buffer overflow in adsmdll.dll 5.3.7.7296, as used by the daemon (dsmsvc.exe) in the backup server in IBM Tivoli Storage Manager (TSM) Express 5.3.7.3 and earlier and TSM 5.2, 5.3 before…
CVE-2006-5855, published 2006-12-06. High severity, CVSS 10.0. EPSS: 26.7% chance of exploitation in the next 30 days. Multiple buffer overflows in IBM Tivoli Storage Manager (TSM) before 5.2.9 and 5.3.x before 5.3.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a…
CVE-2009-3854, published 2009-11-04. High severity, CVSS 10.0. EPSS: 5.8% chance of exploitation in the next 30 days. Buffer overflow in the traditional client scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7 and 5.4 before 5.4.2 allows remote attackers to execute arbitrary code via…
CVE-2010-4606, published 2010-12-29. High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x…
CVE-2002-0541, published 2002-07-03. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Buffer overflow in Tivoli Storage Manager TSM (1) Server or Storage Agents 3.1 through 5.1, and (2) the TSM Client Acceptor Service 4.2 and 5.1, allows remote attackers to cause a denial of service…
CVE-2018-1786, published 2018-11-12. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service.…
CVE-2009-1178, published 2009-03-31. High severity, CVSS 10.0. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and attack vectors related to the "admin command line."
CVE-2004-2762, published 2009-03-31. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the…
CVE-2013-0471, published 2013-02-21. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause…

Latest

CVE-2020-28198, published 2021-05-06. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack buffer overflow. Note: the…
CVE-2018-1550, published 2018-09-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696.
CVE-2017-1378, published 2017-10-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user.…
CVE-2017-1339, published 2017-10-05. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or…
CVE-2017-1301, published 2017-10-05. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files insecurely. A local attacker could exploit…
CVE-2016-8937, published 2017-10-05. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information during authentication.…
CVE-2016-8939, published 2017-06-07. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790.
CVE-2016-8916, published 2017-05-05. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.
CVE-2016-8940, published 2017-03-07. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that…