Security Bulletin: Multiple Java vulnerabilities affect IBM Spectrum Protect Plus

Summary Multiple Java vulnerabilities were disclosed as part of the Java updates in October 2019 and January 2020. The Java vulnerabilities listed below affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: Vulnerability in Swagger affects IBM Spectrum Protect Plus (CVE-2019-17495)

Summary A security vulnerability in Swagger which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS...

Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)

Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...

Security Bulletin: Quartz vulnerability affects IBM Spectrum Protect Plus (CVE-2019-13990)

Summary A security vulnerability in Quartz which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-13990 DESCRIPTION: Terracotta could allow a remote attacker to obtain sensitive information, caused by improper...

CVE-2020-4209

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

CVE-2020-4209

CVE-2020-4209 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. The vulnerability is a path traversal that allows a remote attacker to traverse directories and could result in creation of arbitrary files on the system via specially crafted URL requests containing dot-dot sequences (/../). Several ...

CVE-2020-4209

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

IBM Spectrum Protect Plus Web UI Detection

Binary data ibmsppwebuidetect.nbin...

IBM Spectrum Protect Plus Administrative Console Detection

Binary data ibmsppadminconsoledetect.nbin...

IBM Spectrum Protect Plus username Command Injection

The IBM Spectrum Protect Plus administrative console running on the remote host is affected by a remote command injection vulnerability due to improper validation of user-supplied data when processing a login HTTP request. An unauthenticated, remote attacker can exploit this, via a specially...

Security Bulletin: Authentication Bypass, Arbitrary Directory Deletion, and Command Injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4208, CVE-2020-4214, CVE-2020-4206, CVE-2020-4241, CVE-2020-4242)

Summary IBM Spectrum Protect Plus is vulnerable to authentication bypass, arbitrary directory deletion, and command injection which allows a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4208 DESCRIPTION: IBM Spectrum Protect Plus contains hard-cod...

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Summary There are multiple security vulnerabilities in the Linux Kernel that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-19252 DESCRIPTION: Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw in the...

IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20698)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Path Traversal Vulnerability (CNVD-2020-20703)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A path traversal vulnerability exists in IB...

IBM Spectrum Protect Plus Command Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Arbitrarily Delete Directory Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Authentication Bypass Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Path Traversal Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A path traversal vulnerability exists in IB...

CVE-2020-4241

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...