Unscored severity · published Jul 2, 2014
CVE-2014-3066
IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an…
–
CVSS
2.4%
EPSS
No
On KEV
Description
IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Tivoli Endpoint Manager · Ibm
9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3066
secunia.com
http://secunia.com/advisories/58672
secunia.com
http://secunia.com/advisories/58906
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21673961
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21673967
www.securitytracker.com
http://www.securitytracker.com/id/1030508
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/93630
More from Tivoli Endpoint Manager
5.4
CVE-2012-0718
IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies
–
CVE-2014-6137
Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or…
–
CVE-2014-6113
Cross-site scripting (XSS) vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229 allows remote attackers to inject arbitrary web script or…
–
CVE-2013-0452
Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack…
–
CVE-2013-0453
Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or…