CVE-2020-28198

The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to an exploitable stack buffer overflow. Note: the vulnerability can be exploited when it is used in "interactive" mode while, cause of a max number characters limitation, it cannot be exploited in batch or command line usage (e.g. dsmadmc.exe -id=username -password=pwd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-787

• https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/IBM_ITSM_Administrator_Client_v.5.2.0.1/IBM_TSM_v.5.2.0.1_exploit.pyExploit, Third Party Advisory
• https://voidsec.com/tivoli-madness/#IBM_Tivoli_Storage_ManagerExploit, Third Party Advisory
• https://github.com/VoidSec/Exploit-Development/blob/master/windows/x86/local/IBM_ITSM_Administrator_Client_v.5.2.0.1/IBM_TSM_v.5.2.0.1_exploit.pyExploit, Third Party Advisory
• https://voidsec.com/tivoli-madness/#IBM_Tivoli_Storage_ManagerExploit, Third Party Advisory

Published

May 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28189Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-2819Vulnerability in the Oracle Universal Work Queue product of …8.2
• CVE-2020-28190TerraMaster TOS <= 4.2.06 was found to check for updates (of…5.9
• CVE-2020-28191The console in Togglz before 2.9.4 allows CSRF.8.8
• CVE-2020-28194Variable underflow exists in accel-ppp radius/packet.c when …9.8
• CVE-2020-28196MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.…7.5
• CVE-2020-28199best it Amazon Pay Plugin before 9.4.2 for Shopware exposes …9.1
• CVE-2020-2820Vulnerability in the Oracle Common Applications Calendar pro…8.2
• CVE-2020-28200The Sieve engine in Dovecot before 2.3.15 allows Uncontrolle…4.3
• CVE-2020-28203An issue was discovered in Foxit Reader and PhantomPDF 10.1.…5.5
• CVE-2020-28206An issue was discovered in Bitrix24 Bitrix Framework (1c sit…6.5
• CVE-2020-28208An email address enumeration vulnerability exists in the pas…5.3