CVE-2020-4591

IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746...

CVE-2020-4559

IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613...

Design/Logic Flaw

IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746...

Input validation

IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613...

CVE-2020-4591

IBM Spectrum Protect Server 8.1.0.000–8.1.10.000 is affected by an information disclosure vulnerability arising from occasionally not encrypting the second chunk of an object in an encrypted container pool in non-default settings. This is documented across multiple sources (NVD, IBM security bull...

CVE-2020-4591

IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746...

CVE-2020-4559

IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613...

CVE-2020-4559

CVE-2020-4559 affects IBM Spectrum Protect Server (7.1.x and 8.1.x). Root cause: improper validation of user-supplied input leading to denial of service. Exploitation vector: unauthenticated, remote over the network. Affected versions include 8.1.0.000–8.1.10.000 and 7.1.0.000–7.1.10.x. Remediati...

IBM Spectrum Protect Plus hfpackage Command Injection (CVE-2020-4212)

A command injection vulnerability exists in IBM Spectrum Protect Plus. This vulnerability is due to the missing input validation in Administrative Console service while parsing the parameter...

Security Bulletin: Incorrect permissions on IBM Spectrum Protect Plus agent files (CVE-2020-4631)

Summary IBM Spectrum Protect Plus agent files on Windows have incorrect access permissions. Vulnerability Details CVEID: CVE-2020-4631 DESCRIPTION: IBM Spectrum Protect Plus agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-12406)

Summary IBM WebSphere Application Server Liberty is vulnerable to an Apache CXF denial of service which affects IBM Spectrum Protect Operations Center and Client Management Service. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by...

Security Bulletin: Db2 vulnerabilities affect IBM Spectrum Protect Server (CVE-2020-4230, CVE-2020-4135, CVE-2020-4204, CVE-2020-4200)

Summary The IBM Spectrum Protect Server is affected by multiple Db2 vulnerabilities such as privilege escalation, denial of service, and buffer overflow. Vulnerability Details CVEID: CVE-2020-4230 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 and 11.5 is...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect the IBM Spectrum Protect Server (CVE-2020-2593, CVE-2019-4732)

Summary Multple vulnerabilities exist in IBM Runtime Environment Java which is used by the IBM Spectrum Protect Server. These issues were disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability Details CVEID: CVE-2020-2593 DESCRIPTION: An unspecified vulnerability in Java SE...

IBM Spectrum Protect Plus Denial of Service Vulnerability (CNVD-2020-44566)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus hostname Command Injection

The IBM Spectrum Protect Plus SPP administrative console running on the remote host is affected by a remote command injection vulnerability due to improper validation of user-supplied data when processing a 'set hostname' HTTP request. An unauthenticated, remote attacker can exploit this, via a...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2020-4565)

Summary IBM Spectrum Protect Plus uses insecure communication between the application and server which could allow an attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4565 DESCRIPTION: IBM Spectrum Protect Plus could allow an attacker to obtain sensitive information...

CVE-2020-4631

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

CVE-2020-4631

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service operations. IBM X-Force ID: 185372...

CVE-2020-4631

Summary of CVE-2020-4631 (IBM Spectrum Protect Plus) : Affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. In Windows, agent files in non-default configurations have permissions allowing access to everyone with full control, enabling a local user to potentially interrupt service operations....