Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2022-34165)

Summary An HTTP header injection vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. Vulnerability Details CVEID:CVE-2022-34165 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5,...

CVE-2022-22494: Undefined Security Weakness

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2021-35550, CVE-2021-35603)

Summary Vulnerabilities in IBM® Runtime Environment Java™ were disclosed as part of the IBM Java SDK updates in October 2021. IBM® Runtime Environment Java™, used by IBM Spectrum Protect Operations Center and Client Management Service, may be affected by the below vulnerabilities CVEs...

CVE-2022-22485: Improper Restriction of Excessive Authentication Attempts

In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force...

PT-2022-15464

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 8.1.12 through 8.1.13 Description The issue allows a local attacker to obtain sensitive information. This is caused by plain text user account passwords potentially being stored in the browser's...

CVE-2022-22484: Cleartext Storage of Sensitive Information

IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the browser's application command history. By accessing browser history, an attacker could exploit this...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center Browser's History (CVE-2022-22484)

Summary IBM Spectrum Protect Operations Center may disclose sensitive information in plain text in the brower's application command history. Vulnerability Details CVEID:CVE-2022-22484 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a local attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in IBM Dojo affects IBM Spectrum Protect Operations Center (CVE-2021-23450)

Summary IBM Spectrum Protect Operations Center may be affected by a vulnerability in IBM Dojo CVE-2021-23450 which could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2021-23450 DESCRIPTION: Dojo could allow a remote attacker to execute arbitrar...

PT-2022-15379

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.13.xxx Description The issue allows a page linked to from within Operations Center to rewrite it, potentially leading to reverse tabnabbing. This could enable an administrat...

CVE-2022-22348: Cross-Site Request Forgery (CSRF)

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once...

PT-2022-15378

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.13.xxx Description The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request...

CVE-2022-22346: Cross-Site Request Forgery (CSRF)

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048...

Security Bulletin: Vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty affect IBM Operations Center and Client Management Service (CVE-2021-35578, CVE-2021-35517, CVE-2021-36090)

Summary A denial of service vulnerability in IBM® Runtime Environment Java, disclosed as part of the IBM Java SDK updates in October 2021, can affect IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. Denial of service vulnerabilities in Apache Commons...

Security Bulletin: Vulnerability in Apache Log4j may affect IBM Spectrum Protect Operations Center (CVE-2021-44832)

Summary A vulnerability in Apache Log4j could result in remote code execution. This vulnerability may affect the Help system in IBM Spectrum Protect Operations Center. The below fix packages include Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-44832 DESCRIPTION: Apache Log4j could...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Spectrum Protect Operations Center (CVE-2021-44228)

Summary A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect the Help system in IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to...

PT-2021-22317

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center version 7.1 Description The issue allows a local user to obtain highly sensitive information under special configurations. Recommendations For IBM Spectrum Protect Operations Center version 7.1, at the...

CVE-2021-38901: Exposure of Sensitive Information to an Unauthorized Actor

IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610...

Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Operations Center (CVE-2020-4954, CVE-2020-4955, CVE-2020-4956)

Summary IBM Spectrum Protect Operations Center is vulnerable to execution of arbitrary code on the system, authentication bypass, and denial of service. UPDATED: 15 April 2021 - Added fix for 8.1.11 8.1.11.100. Vulnerability Details CVEID: CVE-2020-4955 DESCRIPTION: IBM Spectrum Protect Operation...

PT-2021-12253

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 7.1 through 8.1 Description The issue is a denial of service caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a large cache value and dumping it to a fi...

PT-2021-12252

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Operations Center versions 7.1 through 8.1 Description The issue is caused by improper parameter validation, allowing a remote attacker to execute arbitrary code on the system. An attacker could exploit this by creating an...