CVE-2021-20490

IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791...

Security Bulletin: Vulnerability in GNU gettext affects IBM Spectrum Protect Plus (CVE-2018-18751)

Summary Denial of service vulnerability in GNU gettext may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2018-18751 DESCRIPTION: GNU gettext is vulnerable to a denial of service, caused by a double free flaw in the defaultaddmessage function in read-catalog.c. By persuading a...

CVE-2021-20536

IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...

CVE-2021-29694

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...

CVE-2021-29694

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...

CVE-2021-20432

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...

Design/Logic Flaw

IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...

Cross site scripting

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...

Code injection

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...

CVE-2021-29694

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...

CVE-2021-29694

CVE-2021-29694 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.7, where weaker cryptographic algorithms (notably 3DES) could allow an attacker to decrypt highly sensitive information. The root cause is use of weaker-than-expected cryptography in the affected release. IBM’s bulletin indicat...

CVE-2021-20536

The vulnerability CVE-2021-20536 affects IBM Spectrum Protect Plus File Systems Agent versions 10.1.6 and 10.1.7, where potentially sensitive information could be stored in and read from local log files. The root cause is an information disclosure in the logging of file-system backup/restore acti...

CVE-2021-20536

IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...

CVE-2021-20432

CVE-2021-20432 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.7. The vulnerability arises from a misconfigured Cross-Origin Resource Sharing (CORS) policy that does not restrict the domain name to trusted domains, potentially enabling an attacker to perform privileged actions and exfiltra...

CVE-2021-20432

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2021-32638)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. An information disclosure vulnerability...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2021-32639)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. An information disclosure vulnerability...

Security Bulletin: IBM Spectrum Protect Plus allows Weak Cryptographic Algorithms (CVE-2021-29694)

Summary Weak cryptographic algorithms such as 3DES may be used by IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2021-29694 DESCRIPTION: IBM Spectrum Protect Plus uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Security Bulletin: Vulnerabilities in Apache and Node.js affect IBM Spectrum Protect Plus

Summary Vulnerabilities in Apache and Node.js such as execution of arbitrary code on the system, cross -site scripting, and bypassing security restrictions, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-28458 DESCRIPTION: Node.js datatables.net module could allow a...

Security Bulletin: Vulnerabilities in Golang affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2021-3114, CVE-2021-3115)

Summary Vulnerabilities in Golang Go may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift. Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an...