CVE-2022-22346

The CVE-2022-22346 entry concerns IBM Spectrum Protect Operations Center (OPC). Affected版本: OPC 8.1.0.000–8.1.13.xxx. Vulnerability: Cross‑Site Request Forgery (CSRF) that could let an attacker perform malicious, unauthorized actions that a trusted user could initiate. Root cause details are not ...

CVE-2022-22346

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

CVE-2022-22354

CVE-2022-22354 affects IBM Spectrum Protect Plus (10.1.0.0–10.1.9.2) and IBM Spectrum Copy Data Management (2.2.0.0–2.2.14.3). The issue is that connections are not length-limited, enabling a Slowloris HTTP denial-of-service attack that can render the Admin Console unresponsive. Affected products...

Vulnerabilities fixed in IBM Spectrum Protect

IBM has fixed vulnerabilities in IBM Spectrum Protect and IBM Spectrum Protect Plus. The vulnerabilities allow a malicious able to launch attacks that result in the following categories of damage: Cross-Site Request Forgery XSRF. Denial-of-Service DoS. Manipulation of data Bypassing authenticatio...

IBM Spectrum Protect Operations Center跨站请求伪造漏洞

IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control of the IBM Spectrum Protect environment. IBM Spectrum Protect Operations Center is vulnerable to cross-site request forgery, which could be exploited by an attacker to vulnerability to enter a link to a...

Security Bulletin: Vulnerabilities in Celery, Golang Go, and Python affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift

Summary Vulnerabilities in Celery, Golang Go, and Python such as execution of arbitrary commands, denial of service, and weaker than expected security might affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and Red Hat OpenShift Vulnerability Details CVEID: CVE-2021-237...

Security Bulletin: Vulnerabilities in Polkit, Node.js, OpenSSH, and Golang Go affect IBM Spectrum Protect Plus (CVE-2021-4034, CVE-2022-21681, CVE-2022-21680, CVE-2022-0235, CVE-2021-41617, CVE-2021-44716, CVE-2021-44717, 218243)

Summary Vulnerabilities in Polkit, Node.js, OpenSSL, and Golang Go can affect IBM Spectrum Protect Plus. The vulnerabilities include elevation of privileges, denial of service, obtaining sensitive information, and bypassing security restrictions. Vulnerability Details CVEID: CVE-2021-4034...

Security Bulletin: Vulnerability in Flask and Python affects IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2021-33026, CVE-2022-0391)

Summary Elevation of privileges vulnerability in Flask and weaker than expected security in Python can affect IBM Spectrum Protect Plus Microsoft® File Systems backup and restore. Vulnerability Details CVEID: CVE-2021-33026 DESCRIPTION: Flask-Caching extension for Flask could allow a local...

Security Bulletin: Reverse Tabnabbing and Cross-Site Request Forgery vulnerabilities in IBM Spectrum Protect Operations Center (CVE-2020-22348, CVE-2020-22346)

Summary IBM Spectrum Protect Operations Center is vulnerable to reverse tabnabbing and cross-site request forgery CSRF. Vulnerability Details CVEID: CVE-2022-22348 DESCRIPTION: IBM Spectrum Protect Operations Center is vulnerable to reverse tabnabbing where it could allow a page linked to from...

Security Bulletin: Vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty affect IBM Operations Center and Client Management Service (CVE-2021-35578, CVE-2021-35517, CVE-2021-36090)

Summary A denial of service vulnerability in IBM® Runtime Environment Java, disclosed as part of the IBM Java SDK updates in October 2021, can affect IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. Denial of service vulnerabilities in Apache Commons...

Security Bulletin: IBM Spectrum Protect Plus is vulnerable to PostgreSQL Man-in-the-Middle and Slowloris Denial of Service attacks (CVE-2021-23222, CVE-2022-22354)

Summary PostgreSQL is vulnerable to a man-in-the-middle attack which can affect IBM Spectrum Protect Plus. In addition, IBM Spectrum Protect Plus is vulnerable to a Slowloris denial of service attack. Vulnerability Details CVEID: CVE-2021-23222 DESCRIPTION: PostgreSQL is vulnerable to a...

CVE-2022-22354

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM...

IBM Spectrum Protect Plus和IBM Spectrum Copy Data Management 安全漏洞

IBM Spectrum Protect Plus and IBM Spectrum Copy Data Management are both products of IBM Corporation, U.S.A. IBM Spectrum Protect Plus is a data protection platform. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual,...

CVE-2022-22346

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048...

CVE-2022-22348

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once...

Security Bulletin: Security vulnerabilities have been identified in the IBM Spectrum Protect Backup-Archive Client that affect multiple IBM Spectrum Protect products

Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client is used as a component of IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for Windows and IBM Spectrum Protect formerly Tivoli Storage Manager HSM for Windows. Information about security...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Spectrum Protect Snapshot on AIX and Linux (CVE-2020-27221)

Summary Vulnerabilities in IBM® Runtime Environment Java™ were disclosed as part of the IBM Java SDK updates in January 2021. IBM® Runtime Environment Java™ is used by IBM Spectrum Protect Snapshot which may be affected by CVE-2020-27221 on AIX and Linux. UPDATED: 26 May 2021 - Added Fix for 4.1...

Security Bulletin: Vulnerability in Apache Log4j may affect IBM Spectrum Protect Snapshot on Windows (CVE-2021-44832)

Summary A vulnerability in Apache Log4j could result in remote code execution. IBM Spectrum Protect Snapshot on Windows includes the IBM Spectrum Protect Backup-Archive Cliient which installs the vulnerable Log4j files. Based on current information and analysis, Log4j is not used by IBM Spectrum...

Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Snapshot for VMware (CVE-2018-1553)

Summary Information disclosure vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for VMware. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remot...