Authorization

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

Code injection

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...

Code injection

IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991...

CVE-2020-4756

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4756: Improper Resource Shutdown or Release

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...

PT-2020-18227

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.23 IBM Spectrum Scale versions 5.0.0.0 through 5.0.5.2 IBM Elastic Storage System versions 6.0.0 through 6.0.1.0 Description The issue allows a local attacker to invoke a subset of ioctls on th...

PT-2020-18225

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows attackers to obtain cookie values by sending an http link to a user or planting this link in a site the user visits. When the user clicks the link, the cookie will ...

CVE-2020-4749: Reliance on Cookies without Validation and Integrity Checking

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4748: Improper Neutralization of Input During Web Page Generation

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517...

CVE-2020-4491: Undefined Security Weakness

IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991...

PT-2020-18224

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2020-18226

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2020-4755: Improper Neutralization of Input During Web Page Generation

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...

PT-2020-18097

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.22 IBM Spectrum Scale versions 5.0.0.0 through 5.0.5 Description The issue allows a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon,...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where a local unprivileged user could cause a denial of service (CVE-2020-4491)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow a local attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4491 DESCRIPTION: IBM Spectrum Scale could allow a local attack...

Security Bulletin: Multiple vulnerabilities affect the IBM Spectrum Scale GUI.

Summary Vulnerabilities exist in all levels of IBM Spectrum Scale GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4749 DESCRIPTION: IBM Spectrum Scale does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get t...

CVE-2020-4756

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...

CVE-2020-4755

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...