CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2018-1786
https://notcve.org/view.php?id=CVE-2018-1786
12 Nov 2018 — IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871. Los procesos dsmc y dsmcad de IBM Spectrum Protect 7.1 y 8.1 acumulan incorrectamente sockets TCP/IP en un estado CLOSE_WAIT. Esto puede provocar el filtrado del recurso TCP/IP y podría resultar en una denegación de servicio (DoS). • http://www.ibm.com/support/docview.wss?uid=ibm10738765 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 62EXPL: 0CVE-2017-1301
https://notcve.org/view.php?id=CVE-2017-1301
05 Oct 2017 — IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system with elevated privileges. IBM X-Force ID: 125163. IBM Spectrum Protect 7.1 y 8.1 podría permitir que un atacante local realice un ataque ... • http://www.ibm.com/support/docview.wss?uid=swg22006248 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.4EPSS: 0%CPEs: 65EXPL: 0CVE-2017-1339
https://notcve.org/view.php?id=CVE-2017-1339
05 Oct 2017 — IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) Server uses weak encryption for the password. A database administrator may be able to decrypt the IBM Spectrum protect client or administrator password which can result in information disclosure or a denial of service. IBM X-Force ID: 126247. El servidor de IBM Spectrum Protect 7.1 y 8.1 (anteriormente Tivoli Storage Manager) utiliza un cifrado de contraseña débil. Un administrador de la base de datos podría descifrar la contraseña del clien... • http://www.ibm.com/support/docview.wss?uid=swg22007936 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.8EPSS: 0%CPEs: 62EXPL: 0CVE-2017-1378
https://notcve.org/view.php?id=CVE-2017-1378
05 Oct 2017 — IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875. IBM Spectrum Protect 7.1 y 8.1 (anteriormente Tivoli Storage Manager) revela las credenciales sin cifrar de inicio de sesión de Vmware vCenter en la salida de la traza de la aplicación, las cuales las puede obtener un usuario local. IBM X-Force ID: 126875. • http://www.ibm.com/support/docview.wss?uid=swg22006215 • CWE-522: Insufficiently Protected Credentials •
CVSS: 9.8EPSS: 0%CPEs: 65EXPL: 0CVE-2016-8937
https://notcve.org/view.php?id=CVE-2016-8937
05 Oct 2017 — The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information during authentication. An attacker could gain user or administrative access to the TSM server. IBM X-Force ID: 118750. El protocolo de autenticación por defecto de IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 y 8.1) es vulnerable a ataques de fuerza bruta ya que revela demasiada información durante el proceso de autenticación. ... • http://www.ibm.com/support/docview.wss?uid=swg22007935 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 65EXPL: 0CVE-2016-8939
https://notcve.org/view.php?id=CVE-2016-8939
07 Jun 2017 — IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790. Clientes y agentes de Tivoli Storage Manager de IBM (Spectrum Protect versiones 7.1 y 8.1 de IBM), almacenan información de contraseñas en el Registro Windows de una manera que pueda verse comprometida. ID de IBM X-Force: 118790. • http://www.ibm.com/support/docview.wss?uid=swg22003738 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 50EXPL: 0CVE-2016-8940
https://notcve.org/view.php?id=CVE-2016-8940
07 Mar 2017 — IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946. IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3 y 7.1 no real... • http://www.ibm.com/support/docview.wss?uid=swg21998946 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 1%CPEs: 17EXPL: 0CVE-2016-8998
https://notcve.org/view.php?id=CVE-2016-8998
24 Feb 2017 — IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747. IBM Tivoli Storage Manager Server 7.1 podría permitir a un usuario autenticado con privilegios de administrador TSM provocar un desbordamiento de búfer utilizando una consulta SQL especialmente manipulada y ejecutar código arbitrario en el servidor. Referencia de IBM: 199874... • http://www.ibm.com/support/docview.wss?uid=swg21998747 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.0EPSS: 0%CPEs: 19EXPL: 0CVE-2016-6043
https://notcve.org/view.php?id=CVE-2016-6043
01 Feb 2017 — Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. Tivoli Storage Manager Operations Center podría permitir a un usuario local asumir el control de un usuario previamente registrado debido a que la expiración de sesión no está forzada. • http://www.ibm.com/support/docview.wss?uid=swg21995754 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 19EXPL: 0CVE-2016-6044
https://notcve.org/view.php?id=CVE-2016-6044
01 Feb 2017 — IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker violate security policy. IBM Tivoli Storage Manager Operations Center podría permitir a un atacante autenticado para habilitar o deshabilitar la APRI REST de la aplicación, lo que puede permitir que el atacante viole la política de seguridad. • http://www.ibm.com/support/docview.wss?uid=swg21995754 • CWE-284: Improper Access Control •