CVE-2019-4703

IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024...

Information disclosure

IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information...

CVE-2020-4213

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024...

CVE-2020-4222

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091...

CVE-2020-4222

CVE-2020-4222 affects IBM Spectrum Protect Plus (versions 10.1.0–10.1.5). The weakness is a command injection flaw in the Administrative Console Framework that, when processing HTTP commands, can lead to remote code execution with the attacker’s payload executed in the context of the target. The ...

CVE-2020-4213

The CVE-2020-4213 entry concerns IBM Spectrum Protect Plus (versions 10.1.0 and 10.1.5). The connected Nessus item documents a remote command injection affecting the administrative console: improper validation of user-supplied data during login HTTP requests enables an unauthenticated attacker to...

CVE-2020-4211

CVE-2020-4211 affects IBM Spectrum Protect Plus 10.1.0 and 10.1.5. A flaw in the Administrative Console Framework allows remote command execution by crafting a hostname parameter in an HTTP request, leading to arbitrary code execution (root). The issue is tied to an incomplete fix and is also ref...

CVE-2020-4212

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 are affected by a command injection vulnerability in the Administrative Console Framework service when parsing the hfpackage parameter, leading to remote code execution with root privileges. Exploitation is possible via specially crafted HTTP commands w...

CVE-2020-4211

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022...

CVE-2020-4212

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023...

CVE-2020-4210

IBM Spectrum Protect Plus versions 10.1.0–10.1.5 are affected by a remote code execution (command injection) vulnerability. The flaw exists in the Administrative Console Framework service and results from lack of proper validation of a user-supplied string before using it to execute a system call...

CVE-2019-4703

Summary: CVE-2019-4703 affects IBM Spectrum Protect Plus. Versions 10.1.0–10.1.5 (and 10.5.0 per some sources) could allow an attacker with intimate knowledge of the system protecting Microsoft SQL or Microsoft Exchange to obtain highly sensitive information (e.g., user IDs and passwords). Techni...

CVE-2020-4210

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020...

CVE-2019-4703

IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...