Skip to main content

Tivoli Endpoint Manager CVE-2014-3066

MEDIUM
Information Exposure (CWE-200)
2014-07-02 psirt@us.ibm.com
IBM XXE Information Disclosure Tivoli Endpoint Manager
5.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 02, 2014 - 10:35 cve.org
MEDIUM 5.0

DescriptionCVE.org

IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

AnalysisAI

IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference,. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Affected products include: Ibm Tivoli Endpoint Manager. Version information: before 9.1.1088.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.

More in Tivoli Endpoint Manager

View all
CVE-2014-6137 MEDIUM POC
4.3 Feb 16

Cross-site scripting (XSS) vulnerability in the Relay Diagnostic page in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229
CVE-2012-0719 MEDIUM POC
4.3 Mar 22

Cross-site scripting (XSS) vulnerability in IBM Tivoli Endpoint Manager (TEM) 8 before 8.2 patch 3 allows remote attacke
CVE-2013-0452 MEDIUM
6.8 Mar 29

Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivol
CVE-2012-4841 MEDIUM
5.0 Nov 29

Unspecified vulnerability in Tivoli Endpoint Manager for Remote Control Broker 8.2 before 8.2.1-TIV-TEMRC821-IF0002 allo
CVE-2012-1837 MEDIUM
5.0 Mar 22

The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before

CVE-2014-6113 MEDIUM
4.3 Feb 16

Cross-site scripting (XSS) vulnerability in the Web Reports component in IBM Tivoli Endpoint Manager 9.1 before 9.1.1229
CVE-2013-0453 LOW
3.5 Mar 21

Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remo

Same weakness CWE-200 – Information Exposure

View all
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2016-2388 MEDIUM POC
5.3
CVE-2016-1561 HIGH POC
7.5

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2014-3066 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy