Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP command to the remote server. IBM X-Force ID: 181726...

Code injection

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779...

CVE-2020-4477

CVE-2020-4477 affects IBM Spectrum Protect Plus, versions 10.1.0–10.1.5, where highly sensitive information is disclosed in plain text in the virgo log file. The underlying issue is exposure of credentials/data in logs, enabling information disclosure as described by IBM. Remediation: upgrade to ...

CVE-2020-4477

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779...

CVE-2020-4470

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725...

CVE-2020-4471

IBM Spectrum Protect Plus 10.1.0–10.1.5 is affected by CVE-2020-4471. An unauthenticated attacker could cause a denial of service or hijack DNS sessions by sending a specially crafted HTTP command to the remote server. Impact is described in the cited IBM bulletin and external references, with CV...

CVE-2020-4469

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. This vulnerability is due to an incomplete fix...

CVE-2020-4469

IBM Spectrum Protect Plus 10.1.0–10.1.5 is affected by a remote code execution via hostname command injection. The issue stems from improper validation of the hostname parameter in the HTTP request to the Administrative Console Framework, allowing unauthenticated, remote attackers to execute arbi...

CVE-2020-4216

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 175066...

Security Bulletin: Denial of Service vulnerability in Linux Kernel affects IBM Spectrum Protect Plus (CVE-2020-12114)

Summary There is a denial of service vulnerability in the Linux Kernel that affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-12114 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a pivotroot race condition in fs/namespace.c. By corrupting a...

IBM Spectrum Protect Plus Code Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-33088)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Hardcoded Username And Password Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of login requests to the Discovery Server service. The product...

IBM Spectrum Protect Plus Denial of Service Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-33087)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus File Upload Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

Security Bulletin: Information Disclosure via IBM Spectrum Protect Plus virgo log file (CVE-2020-4477)

Summary IBM Spectrum Protect Plus virgo log file may disclose sensitive information in plain text. Vulnerability Details CVEID: CVE-2020-4477 DESCRIPTION: IBM Spectrum Protect Plus discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks...

Security Bulletin: IBM Spectrum Protect Plus vulnerable to Logjam (CVE-2015-4000)

Summary A port used by VADP is reported to be vulnerable to Logjam CVE-2015-4000. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHEEXPORT ciphersuite choice. An...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938)

Summary An Apache Tomcat vulnerability which could allow a remote attacker to execute arbitrary code on the system affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-1938 DESCRIPTION: Apache Tomcat could allow a remote attacker to execute arbitrary code on the system, caused...

Security Bulletin: Vulnerabilities in FasterXML jackson-databind affect IBM Spectrum Protect Plus (CVE-2020-9548, CVE-2020-9546. CVE-2020-9547, CVE-2020-8840, CVE-2019-20330)

Summary Multiple vulnerabilities in FasterXML jackson-databind affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-9548 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by the mishandling of interaction betwe...