622 matches found
PT-2021-18412
Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.7 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For I...
CVE-2021-20536: Insertion of Sensitive Information into Log File
IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...
CVE-2021-20432: Undefined Security Weakness
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...
CVE-2021-29694: Use of a Broken or Risky Cryptographic Algorithm
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...
PT-2021-13962
Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Plus versions 10.1.0 through 10.1.7 Description: The issue allows an attacker to perform privileged actions and retrieve sensitive information due to the use of Cross-Origin Resource Sharing CORS without limiting the doma...
Security Bulletin: IBM Spectrum Protect Plus allows Weak Cryptographic Algorithms (CVE-2021-29694)
Summary Weak cryptographic algorithms such as 3DES may be used by IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2021-29694 DESCRIPTION: IBM Spectrum Protect Plus uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
Security Bulletin: Vulnerabilities in Apache and Node.js affect IBM Spectrum Protect Plus
Summary Vulnerabilities in Apache and Node.js such as execution of arbitrary code on the system, cross -site scripting, and bypassing security restrictions, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-28458 DESCRIPTION: Node.js datatables.net module could allow a...
Security Bulletin: Vulnerabilities in Golang affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2021-3114, CVE-2021-3115)
Summary Vulnerabilities in Golang Go may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift. Vulnerability Details CVEID: CVE-2021-3114 DESCRIPTION: An unspecified error with the P224 Curve implementation can generate incorrect outputs in Golang Go has an...
Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems backup and restore (CVE-2020-25659)
Summary Vulnerability in python-cryptography may affect IBM Spectrum Protect Plus Microsoft® File Systems backup and restore. Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timi...
Security Bulletin: Static Credential Vulnerability in IBM Spectrum Protect Plus (CVE-2020-4854)
Summary IBM Spectrum Protect Plus contains hard-coded credentials which could allow a remote attacker to gain elevated privileges. UPDATED: 24 February 2021 - Remediation/Fixes section updated with additional vSnap requirements for upgrading to 10.1.7. UPDATED: 23 April 2021 - Added 10.1.8 fix...
Security Bulletin: Cross-Origin Resource Sharing (CORS) vulnerability in IBM Spectrum Protect Plus (CVE-2021-20432)
Summary Cross-Origin Resource Sharing CORS vulnerability in IBM Spectrum Protect Plus may allow privileged actions and retrieval of sensitive information. Vulnerability Details CVEID: CVE-2021-20432 DESCRIPTION: IBM Spectrum Protect Plus uses Cross-Origin Resource Sharing CORS which could allow a...
CVE-2021-20536
IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...
PT-2021-5678
Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus File Systems Agent versions 10.1.6 through 10.1.7 Description The issue is related to insufficient protection of registration data, which could allow an attacker to disclose protected information. Specifically, the...
CVE-2021-29694
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 200258...
IBM Spectrum Protect Plus 安全漏洞
IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. An information disclosure vulnerability...
CVE-2021-20432
IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 196344...
IBM Spectrum Protect Plus 加密问题漏洞
IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus has a security...
Security Bulletin: Vulnerabilities in Linux Kernel and Java affect IBM Spectrum Protect Plus
Summary Multiple vulnerabilities in the Linux Kernel and Java may affect IBM Spectrum Protect Plus. The Java vulnerabilities were disclosed as part of the Java Critical Patch Updates in July and October 2020. UPDATED: 3 March 2021: Added CVE-2020-10711 Vulnerability Details CVEID: CVE-2020-14782...
IBM Spectrum Protect Plus Denial of Service Vulnerability (CNVD-2021-12645)
IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A denial of service vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.7. A remote user can exploit...
