CVE-2020-5020

IBM Spectrum Protect Plus 10.1.0–10.1.6 is affected by a clickjacking vulnerability (CVE-2020-5020) that could allow a remote attacker to hijack a victim’s click actions by convincing them to visit a malicious site. The issue is documented across multiple sources (NVD, CNVD/CVELIST entries, and I...

CVE-2020-5021

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657...

CVE-2020-5020

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-5019

CVE-2020-5019 affects IBM Spectrum Protect Plus 10.1.0–10.1.6. The vulnerability is an HTTP header injection caused by improper validation of the Host header, which an attacker can exploit by sending a crafted HTTP request to inject the Host header and trigger attacks such as cross-site scripting...

CVE-2020-5019

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the...

CVE-2020-5017

Summary of CVE-2020-5017 : IBM Spectrum Protect Plus affected versions 10.1.0–10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions (information disclosure). This vulnerability is documented across multiple sources (IBM X-Force ID 193653; CNVD/CV...

CVE-2020-5018

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an attacker. IBM X-Force ID: 193654...

CVE-2020-5018

CVE-2020-5018 affects IBM Spectrum Protect Plus 10.1.0–10.1.6, where URLs may disclose sensitive information, per the NVD entry and IBM bulletin. The issue is an information disclosure vulnerability related to how URLs are generated/structured, increasing risk of capture by an attacker. A remedia...

CVE-2020-5017

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653...

CVE-2020-5019: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the...

CVE-2020-5021: Session Fixation

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657...

CVE-2020-5018: Cleartext Storage of Sensitive Information

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an attacker. IBM X-Force ID: 193654...

PT-2021-12284

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6 Description The issue allows sensitive information to be included in URLs, increasing the risk of this information being captured by an attacker. Recommendations For IBM Spectrum Protect...

PT-2021-12288

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6 Description The issue allows unauthenticated and unauthorized access to the VDAP proxy, which can result in an attacker obtaining information they are not authorized to access...

PT-2021-12285

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6 Description The issue is caused by improper validation of input by the HOST headers, allowing a remote attacker to inject HTTP HOST headers by sending a specially crafted HTTP request...

IBM Spectrum Protect Plus 授权问题漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A session fixation vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability stems fr...

IBM Spectrum Protect,IBM Spectrum Protect Plus 安全漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker could...

IBM Spectrum Protect Plus 安全漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A clickjacking vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can exploit this...

IBM Spectrum Protect Plus 信息泄露漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker can explo...

PT-2021-12287

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.6 Description The issue allows a local user to impersonate another user on the system because sessions are not invalidated after a password reset. Recommendations For IBM Spectrum Protect...