Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

Cross site scripting

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

CVE-2022-22354

CVE-2022-22354 affects IBM Spectrum Protect Plus (10.1.0.0–10.1.9.2) and IBM Spectrum Copy Data Management (2.2.0.0–2.2.14.3). The issue is that connections are not length-limited, enabling a Slowloris HTTP denial-of-service attack that can render the Admin Console unresponsive. Affected products...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22344

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

CVE-2022-22344

The CVE-2022-22344 issue affects IBM Spectrum Copy Data Management, specifically the HOST header input validation in versions 2.2.0.0 through 2.2.14.3. The root cause is improper validation of HOST headers, enabling HTTP header injection that could lead to cross-site scripting, cache poisoning, o...

CVE-2021-39055

This CVE affects IBM Spectrum Copy Data Management (version 2.2.0.0 through 2.2.14.3). The root cause is an XSS vulnerability in the Web UI due to insufficient input validation/filtering, enabling an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted sess...

CVE-2021-39055

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2021-39051

CVE-2021-39051 affects IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3. The vulnerability is a server‑side request forgery (SSRF) caused by improper input handling in the application server registration function. A remote attacker can craft the host address and port fields in ...

CVE-2021-39051

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server...

IBM Spectrum Copy Data Management代码问题漏洞

IBM Spectrum Copy Data Management is an International Business Machines Corporation IBM implementation to modernize, simplify, and automate data center copy management processes. IBM Spectrum Copy Data Management has a security vulnerability that is caused by improperly entered application server...

IBM Spectrum Copy Data Management 注入漏洞

IBM Spectrum Copy Data Management is an IBM company that modernizes, streamlines and automates data center copy management processes. IBM Spectrum Copy Data Management has security vulnerabilities that can be exploited by attackers to conduct a variety of attacks on vulnerable systems, including...

IBM Spectrum Copy Data Management 跨站脚本漏洞

IBM Spectrum Copy Data Management is an implementation of International Business Machines Corporation IBM to modernize, simplify, and automate data center copy management processes.A cross-site scripting vulnerability exists in IBM Spectrum Copy Data Management versions 2.2.0.0 inclusive through...

Security Bulletin: IBM Spectrum Copy Data Management is vulnerable to Slowloris, HTTP header injection, XSS, and CSRF (CVE-2022-22354, CVE-2022-22344, CVE-2021-39055, CVE-2021-39051)

Summary IBM Spectrum Copy Data Management is vulnerable to Slowloris HTTP denial of service, HTTP header injection, cross-site scripting XSS, and server-side request forgery CSRF attacks. Vulnerability Details CVEID: CVE-2022-22354 DESCRIPTION: IBM Spectrum Protect Plus and IBM Spectrum Copy Data...

Security Bulletin: Vulnerabilities in Polkit, PostgreSQL, OpenSSL, OpenSSH, and jQuery affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Polkit, PostgreSQL, OpenSSL, OpenSSH, and jQuery can affect IBM Spectrum Copy Data Management. Vulnerabilities include elevated privileges, SQL injection, obtaining sensitive information, cross-site scripting, and man-in-the-middle attacks. Vulnerability Details CVEID:...

CVE-2021-39055

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management 安全漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

CVE-2022-22344

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or...

CVE-2021-39051

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could exploit this vulnerability using the host address and port fields of the application server...