IBM Spectrum Protect Plus 信息泄露漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker can explo...

IBM Spectrum Protect Plus 授权问题漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A session fixation vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability stems fr...

Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-5017, CVE-2020-5018, CVE-2020-5019, CVE-2020-5020, CVE-2020-5021, CVE-2020-5022)

Summary IBM Spectrum Protect Plus is vulnerable to exposure of sensitive data, clickjacking, HTTP header injection, failure to invalidate sessions, and unauthorized access to information. Vulnerability Details CVEID: CVE-2020-5018 DESCRIPTION: IBM Spectrum Protect Plus may include sensitive...

CVE-2020-5017

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653...

CVE-2020-5020

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-5021

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657...

Security Bulletin: Denial of Service Vulnerability in Chart.js affects IBM Spectrum Protect Plus (CVE-2020-7746)

Summary The Node.js chart.js module is vulnerable to a denial of service which may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-7746 DESCRIPTION: Node.js chart.js moudle is vulnerable to a denial of service, caused by a prototype pollution flaw when processing the optio...

Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137)

Summary Urllib3 is vulnerable to CRLF injection which could allow a remote attacker to perform cross-site scripting, cache poisoning, or session hijacking attacks. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsof...

Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747)

Summary There is a vulnerability in PyYAML that could allow a remote attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-66199)

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 through 10.1.6. The...

IBM Spectrum Protect Plus Hardcoded Credentials Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A hard-coded credentials vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Information disclosure

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Hardcoded credentials

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4854

IBM Spectrum Protect Plus versions 10.1.0–10.1.6 contain hard-coded credentials used for inbound authentication, outbound communication, or data encryption, representing a high-severity vulnerability (CVSS v3.1 score up to 9.8) with network exposure. The root cause is embedded credentials in the ...

CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4783

CVE-2020-4783 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. Root cause: failure to properly enable HTTP Strict Transport Security, enabling information disclosure via man-in-the-middle. Impact: remote attacker could obtain sensitive information over network (TLS/HTTPS). Affected produ...