CVE-2020-4755

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...

CVE-2020-4749

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4748

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517...

CVE-2020-4748

CVE-2020-4748 concerns IBM Spectrum Scale 5.0.0–5.0.5.2, where the Web UI is vulnerable to cross-site scripting, allowing arbitrary JavaScript in a trusted session and potential credential disclosure. The IBM bulletin confirms the affected range and notes a remediation: upgrade to code levels 5.0...

CVE-2020-4749

CVE-2020-4749 affects IBM Spectrum Scale 5.0.0 through 5.0.5.2, where authorization tokens or session cookies are issued without the secure attribute, enabling cookie snooping if a user visits an http link. Impact is limited to disclosure of cookie values via insecure requests; exploitation requi...

CVE-2020-4491

IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991...

CVE-2020-4491

The CVE pertains to IBM Spectrum Scale where a local unprivileged user can reliably cause a denial of service by flooding the mmfsd daemon with RPC requests, potentially crashing the service. Affected versions are IBM Spectrum Scale V4.2.0.0–V4.2.3.22 and V5.0.0.0–V5.0.5. The underlying cause is ...

CVE-2020-4755: Improper Neutralization of Input During Web Page Generation

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595...

CVE-2020-4756: Improper Resource Shutdown or Release

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...

PT-2020-18227

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.23 IBM Spectrum Scale versions 5.0.0.0 through 5.0.5.2 IBM Elastic Storage System versions 6.0.0 through 6.0.1.0 Description The issue allows a local attacker to invoke a subset of ioctls on th...

PT-2020-18097

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.2.0.0 through 4.2.3.22 IBM Spectrum Scale versions 5.0.0.0 through 5.0.5 Description The issue allows a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon,...

PT-2020-18224

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2020-18226

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2020-18225

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0 through 5.0.5.2 Description The issue allows attackers to obtain cookie values by sending an http link to a user or planting this link in a site the user visits. When the user clicks the link, the cookie will ...

CVE-2020-4748: Improper Neutralization of Input During Web Page Generation

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517...

CVE-2020-4749: Reliance on Cookies without Validation and Integrity Checking

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...

CVE-2020-4491: Undefined Security Weakness

IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where a local unprivileged user could cause a denial of service (CVE-2020-4491)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow a local attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4491 DESCRIPTION: IBM Spectrum Scale could allow a local attack...

Security Bulletin: Multiple vulnerabilities affect the IBM Spectrum Scale GUI.

Summary Vulnerabilities exist in all levels of IBM Spectrum Scale GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4749 DESCRIPTION: IBM Spectrum Scale does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get t...

CVE-2020-4756

IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM...