Summary
Detail | |||
---|---|---|---|
Vendor | Ibm | First view | 2014-07-01 |
Product | Tivoli Application Dependency Discovery Manager | Last view | 2024-02-02 |
Version | 7.2.0.8 | Type | Application |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:a:ibm:tivoli_application_dependency_discovery_manager |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
6.1 | 2024-02-02 | CVE-2023-47144 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 270271. |
9.8 | 2024-02-02 | CVE-2023-47143 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270. |
8.8 | 2024-02-02 | CVE-2023-47142 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267. |
7.5 | 2019-02-04 | CVE-2018-1675 | IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110. |
7.5 | 2018-07-09 | CVE-2013-3017 | IBM Tivoli Application Dependency Discovery Manager (TADDM) before 7.2.1.5 and 7.2.x before 7.2.2 make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging support for weak SSL ciphers. IBM X-Force ID: 84353. |
8.1 | 2018-05-24 | CVE-2013-3023 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361. |
5.3 | 2018-05-24 | CVE-2013-3018 | The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354. |
5.5 | 2018-05-01 | CVE-2013-4040 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2.x before 7.2.1.5 and 7.2.x before 7.2.2.0 on Unix use weak permissions (755) for unspecified configuration and log files, which allows local users to obtain sensitive information by reading the files. IBM X-Force ID: 86176. |
3.5 | 2014-10-31 | CVE-2014-6148 | IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 does not require TADDM authentication for rptdesign downloads, which allows remote authenticated users to obtain sensitive database information via a crafted URL. |
5 | 2014-10-29 | CVE-2014-6149 | Directory traversal vulnerability in BIRT-viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0.0 through 7.2.0.10, 7.2.1.0 through 7.2.1.6, and 7.2.2.0 through 7.2.2.2 allows remote authenticated users to read arbitrary files via unspecified vectors. |
3.5 | 2014-07-01 | CVE-2013-3004 | Directory traversal vulnerability in BIRT-Report Viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.x and 7.2.x before 7.2.1.5 allows remote authenticated users to read arbitrary files via unspecified vectors. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
27% (3) | CWE-200 | Information Exposure |
18% (2) | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path ... |
9% (1) | CWE-310 | Cryptographic Issues |
9% (1) | CWE-287 | Improper Authentication |
9% (1) | CWE-275 | Permission Issues |
9% (1) | CWE-264 | Permissions, Privileges, and Access Controls |
9% (1) | CWE-116 | Improper Encoding or Escaping of Output |
9% (1) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2014-06-23 | Name: The remote openSUSE host is missing a security update. File: openSUSE-2014-435.nasl - Type: ACT_GATHER_INFO |