Security Bulletin: IBM Spectrum Copy Data Management is vulnerable to bypassing authentication, information disclosure, XSS, CSRF, and reverse tabnabbing

Summary IBM Spectrum Copy Data Management is vulnerable to bypassing authentication restrictions, information disclosure due to an unnecessary open port, cross-site scripting XSS, cross-site request forgery CSRF, and reverse tabnabbing. Vulnerability Details CVEID:CVE-2022-22426 DESCRIPTION: IBM...

Security Bulletin: Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Golang Go, OpenSSL, Python, and XStream, such as bypassing security restrictions and denial of service, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an...

Security Bulletin: Vulnerabilities in the Linux Kernel affect IBM Spectrum Copy Data Management

Summary Linux Kernel vulnerabilities, such as obtaining sensitive information, bypassing security restrictions, denial of service, elevation of privileges, and execution of arbitrary code on the system, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2022-0850...

CVE-2022-30611

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject malicious script into a Web page whic...

CVE-2022-22479

IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 225887...

CVE-2022-30610

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Onc...

Design/Logic Flaw

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

CVE-2022-22396 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.9.3, where credentials may be disclosed in plaintext in the virgo log file in certain operations (remote vSnap, offload targets, or VADP credentials). API-key or certificate credentials are not printed. The issue’s root cause is infor...

Security Bulletin: IBM Spectrum Protect Plus may disclose sensitive information in virgo log file (CVE-2022-22396)

Summary IBM Spectrum Protect Plus may disclose credentials in clear text in the virgo log file. Vulnerability Details CVEID:CVE-2022-22396 DESCRIPTION: Credentials are printed in clear text in the IBM Spectrum Protect Plus virgo log file in certain cases. Credentials could be the remote vSnap,...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow an attacker to decrypt highly sensitive information(CVE-2022-22368)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow an attacker to decrypt highly sensitive information. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2022-22368 DESCRIPTION: IBM Spectrum Scale uses weaker than...

Security Bulletin: Multiple vulnerabilities in Apache Log4j affect IBM Cloud Pak System

Summary Multple vulnerabilities exist in Apache log4j that could allow someone to execute arbitrary code on the system. Apache Log4j v1 is used by Cloud Pak System in order to generate logs and diagnostic traces in some of its components; IBM DB2 , IBM Tivoli Monitoring, IBM Spectrum Scale and IB...

Security Bulletin: Vulnerability in OpenSSL affects IBM Spectrum Control (CVE-2022-1292)

Summary A vulnerability in OpenSSL could allow an attacker to execute arbitrary commands on the system. This vulnerability may affect IBM Spectrum Control due to its use of OpenSSL in the Storage Resource Agent component and XIV storage probe. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION...

Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE

Summary Vulnerabilities in XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE such as execution of arbitrary code, denial of service, server-side request forgery, amd weaker than expected security may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-4160 DESCRIPTION: OpenSSL...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storage System GUI where authorised user can execute unauthorized function (CVE-2020-4378)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage System 3000 GUI. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2020-4378 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to...

Security Bulletin: IBM Elastic Storage System 3000 is affected by weak cryptographic algorithm (CVE-2020-4350)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage System 3000 GUI. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2020-4350 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithm...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storage System 3000 GUI where an unauthorised user can execute commands (CVE-2020-4348)

Summary A security vulnerability has been identified in IBM Elastic Storage System 3000 GUI that could allow an unauthorised user to execute commands . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4348 DESCRIPTION: IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 an...

Security Bulletin: IBM Elastic Storage System 3000 are affected by a vulnerability in IBM Spectrum Scale (CVE-2020-4412)

Summary Elastic Storage System 3000 is affected by a vulnerability in IBM Spectrum Scale which could cause a denial of service. Vulnerability Details CVEID: CVE-2020-4412 DESCRIPTION: The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a...

Security Bulletin: A vulnerability in IBM JAVA JDK affects IBM Spectrum Scale packaged in IBM Elastic Storage System (CVE-2022-21291)

Summary There is a vulnerability in IBM Java JDK, used by IBM Elastic Storage System GUI, which could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact and no availability impact. Vulnerability Details CVEID:CVE-2022-21291 DESCRIPTION: An unspecified...