Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Operations Center and Client Management Service

Summary There are multiple vulnerabilities in IBM WebSphere Application Server Liberty that affect IBM Spectrum Protect Operations Center and Client Management Service. Vulnerabilities include spoofing attacks, security bypass, denial of service, and information disclosure. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-4732, CVE-2019-2989, CVE-2019-2964)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. These issues were disclosed as part of the IBM Java SDK updates in October 2019 and January 2020. Vulnerability...

Security Bulletin: Vulnerability in IBM Java Runtime affects the IBM Spectrum Protect Server (CVE-2019-2989)

Summary A vulnerability exists in IBM Runtime Environment Java which is used by the IBM Spectrum Protect Server. This issue was disclosed as part of the IBM Java SDK updates in October 2019. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allo...

Security Bulletin: Vulnerability in Go programming language affects IBM Spectrum Protect Server (CVE-2019-16276)

Summary The Go programming language could allow a remote attacker to bypass security restrictions which affects the IBM Spectrum Protect Server. Vulnerability Details CVEID: CVE-2019-16276 DESCRIPTION: Golang could allow a remote attacker to bypass security restrictions, caused by improper...

Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect Operations Center (CVE-2020-5259, CVE-2020-5258)

Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype...

Security Bulletin: IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management web user interface vulnerable to authentication bypass and clickjacking (CVE-2020-4494, CVE-2020-4406)

Summary The web user interface provided by the IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management is vulnerable to authentication bypass and a clickjacking attack. Vulnerability Details CVEID: CVE-2020-4494 DESCRIPTION: The IBM Spectrum Protect Backup-Archive Client web use...

Security Bulletin: Information Disclosure via IBM Spectrum Protect Plus virgo log file (CVE-2020-4477)

Summary IBM Spectrum Protect Plus virgo log file may disclose sensitive information in plain text. Vulnerability Details CVEID: CVE-2020-4477 DESCRIPTION: IBM Spectrum Protect Plus discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks...

Security Bulletin: IBM Spectrum Protect Plus vulnerable to Logjam (CVE-2015-4000)

Summary A port used by VADP is reported to be vulnerable to Logjam CVE-2015-4000. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHEEXPORT ciphersuite choice. An...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938)

Summary An Apache Tomcat vulnerability which could allow a remote attacker to execute arbitrary code on the system affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-1938 DESCRIPTION: Apache Tomcat could allow a remote attacker to execute arbitrary code on the system, caused...

Security Bulletin: Vulnerabilities in FasterXML jackson-databind affect IBM Spectrum Protect Plus (CVE-2020-9548, CVE-2020-9546. CVE-2020-9547, CVE-2020-8840, CVE-2019-20330)

Summary Multiple vulnerabilities in FasterXML jackson-databind affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-9548 DESCRIPTION: FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system, caused by the mishandling of interaction betwe...

Security Bulletin: Multiple Java vulnerabilities affect IBM Spectrum Protect Plus

Summary Multiple Java vulnerabilities were disclosed as part of the Java updates in October 2019 and January 2020. The Java vulnerabilities listed below affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-2604 DESCRIPTION: An unspecified vulnerability in Java SE could allow an...

Security Bulletin: Vulnerability in Swagger affects IBM Spectrum Protect Plus (CVE-2019-17495)

Summary A security vulnerability in Swagger which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS...

Security Bulletin: Vulnerability in MongoDB affects IBM Spectrum Protect Plus (CVE-2019-2389)

Summary A denial of service vulnerability in MongoDB affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-2389 DESCRIPTION: MongoDB Server is vulnerable to a denial of service, caused by a flaw in the SysV init scripts. By inserting a specially-crafted PID file, a remote...

Security Bulletin: Quartz vulnerability affects IBM Spectrum Protect Plus (CVE-2019-13990)

Summary A security vulnerability in Quartz which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-13990 DESCRIPTION: Terracotta could allow a remote attacker to obtain sensitive information, caused by improper...

IBM Spectrum Protect 7.1.x < 7.1.10.100 / 8.1.x < 8.1.9.300 Stack-based Buffer Overflow

IBM Spectrum Protect, formerly known as Tivoli Storage Manager, running on the remote host is version 7.1.x 7.1.10.100 or 8.1.x 8.1.9.300. It is, therefore, is vulnerable to a stack-based buffer overflow which could allow an unauthenticated, remote attacker to executive arbitrary code on the syst...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Spectrum Protect for Enterprise Resource Planning on Windows (CVE-2019-4732)

Summary Multiple vulnerabilities in IBM Java Runtime Environment were disclosed as part of the IBM Java SDK updates in January 2020. IBM Java Runtime Environment, used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning. has addressed the applicable CVE which...

CVE-2020-4209

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...

CVE-2020-4209

CVE-2020-4209 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. The vulnerability is a path traversal that allows a remote attacker to traverse directories and could result in creation of arbitrary files on the system via specially crafted URL requests containing dot-dot sequences (/../). Several ...

CVE-2020-4209

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to create arbitrary files on the system. IBM X-Force ID: 175019...