CVE-2021-39063

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...

CVE-2021-39063

CVE-2021-39063 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.8.x. A misconfiguration in Cross-Origin Resource Sharing (CORS) headers can allow an attacker to perform privileged actions and disclose sensitive information. The incident is corroborated by multiple sources (NVD entry for CVSS 3.1 b...

CVE-2021-39057

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...

CVE-2021-39057

IBM Spectrum Protect Plus (10.1.0.0–10.1.8.x) is affected by a server‑side request forgery (SSRF) vulnerability due to insufficient input filtering/validation on the server. An authenticated attacker could send unauthorized requests from the vulnerable system, enabling network enumeration and fac...

CVE-2021-39048

CVE-2021-39048 affects IBM Spectrum Protect Client 7.1 and 8.1, with a stack-based buffer overflow due to improper bounds checking. Local attackers could cause a denial of service. Public sources (e.g., Gentoo GLSA 202209-02) indicate fixes are available: upgrade to IBM Spectrum Protect Client 7....

CVE-2021-39048

IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this vulnerability and cause a denial of service. IBM X-Force ID: 214438...

CVE-2021-38901

CVE-2021-38901 affects IBM Spectrum Protect Operations Center (7.1.x: 7.1.0.000–7.1.13.x). Under special configurations, a local user could obtain highly sensitive information; the issue stems from tracing exposing credentials in trace files (plain text). CVSS: vector and scores indicate a MEDIUM...

CVE-2021-38901

IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610...

CVE-2020-4496

The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...

CVE-2020-4496

IBM Spectrum Protect Plus (IBM Spectrum Protect Plus server connected to a workload agent) is affected by CVE-2020-4496: MITM due to improper certificate validation in versions 10.1.0.0–10.1.8.x. The IBM security bulletin lists a fix in Spectrum Protect Plus 10.1.9 (Linux) and notes remediation/w...

PT-2021-22359 · Ibm · Ibm Spectrum Protect Client

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Protect Client versions 7.1 through 8.1 Description: The issue is caused by improper bounds checking, leading to a stack-based buffer overflow. A local attacker could exploit this and cause a denial of service. Recommendations: F...

Multiple vulnerabilities fixed in IBM Spectrum Protect

IBM has fixed vulnerabilities in Spectrum Protect and software bundled with Spectrum Protect. The bundled software covers previously fixed vulnerabilities in underlying products and libraries such as Golang, DB2, Node.js, PostgreSQL, OpenSSH, OpenSSH and others. Previous security advisories...

Security Bulletin: Vulnerabilities in Redis, OpenSSH, Golang Go, and Apache Kafka may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift

Summary IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift may be affected by vulnerabilities in Redis, OpenSSH, Golang Go, and Apache Kafka such as bypass of security restrictions, denial of service, execution of arbitrary code, elevation of privileges, buffer...

Security Bulletin: IBM Spectrum Protect Plus is vulnerable to SSRF, MITM, and CORS attacks

Summary IBM Spectrum Protect Plus is vulnerable to Server-Side Request Forgery SSRF, Man-in-the-Middle MITM attack, and Cross-Origin Resource Sharing CORS attack. Vulnerability Details CVEID: CVE-2021-39057 DESCRIPTION: IBM Spectrum Protect Plus is vulnerable to server-side request forgery SSRF...

Security Bulletin: Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus

Summary Vulnerabilities in Node.js, Color-String, and PostgreSQL, such as denial of service, bypassing security restrictions, obtaining sensitive information, and execution of arbitrary code, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-28469 DESCRIPTION: Node.js...

Security Bulletin: Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX affect IBM Spectrum Protect Plus

Summary Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX such as directory traversal, execution of arbitrary commands, obtaining sensitive information, elevated privileges, bypassing security restrictions, and denial of service, may affect IBM Spectrum Protect Plus. Vulnerability...

Security Bulletin: Stack-based Buffer Overflow vulnerability in IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management (CVE-2021-39048)

Summary IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Space Management are vulnerable to a stack-based buffer overflow caused by improper bounds checking. Vulnerability Details CVEID: CVE-2021-39048 DESCRIPTION: IBM Spectrum Protect Client is vulnerable to a stack based...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Spectrum Protect Backup-Archive Client NetApp Services (CVE-2021-3712, CVE-2021-3711)

Summary OpenSSL vulnerabilities were disclosed on August 24, 2021 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect Backup-Archive Client for network connections with NetApp services, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSS...

Security Bulletin: Vulnerabilities in Golang Go may affect IBM Spectrum Protect Server (CVE-2021-33195, CVE-2021-33197, CVE-2021-36221)

Summary The IBM Spectrum Protect Server may be affected by Golang Go vulnerabilities such as denial of service, execution of arbitrary code, and bypassing of security restrictions. Vulnerability Details CVEID: CVE-2021-33195 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrar...

Security Bulletin: Vulnerabilities in IBM Db2 affect IBM Spectrum Protect Server (CVE-2021-29777, CVE-2021-20579, CVE-2021-29703, CVE-2020-4885, CVE-2020-4945)

Summary The IBM Spectrum Protect Server may be affected by IBM Db2 vulnerabilities such as denial of service, obtaining sensitive information, accessing or changing Db2 configuration, and overwriting arbitrary files. Vulnerability Details CVEID: CVE-2021-29777 DESCRIPTION: IBM Db2 for Linux, UNIX...