3686 matches found
CVE-2020-4496
The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...
CVE-2021-38901
IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610...
Code injection
IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610...
Design/Logic Flaw
The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...
Stack overflow
IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this vulnerability and cause a denial of service. IBM X-Force ID: 214438...
Design/Logic Flaw
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...
Server side request forgery (ssrf)
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...
CVE-2021-39063
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing CORS which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956...
CVE-2021-39063
CVE-2021-39063 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.8.x. A misconfiguration in Cross-Origin Resource Sharing (CORS) headers can allow an attacker to perform privileged actions and disclose sensitive information. The incident is corroborated by multiple sources (NVD entry for CVSS 3.1 b...
CVE-2021-39057
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616...
CVE-2021-39057
IBM Spectrum Protect Plus (10.1.0.0–10.1.8.x) is affected by a server‑side request forgery (SSRF) vulnerability due to insufficient input filtering/validation on the server. An authenticated attacker could send unauthorized requests from the vulnerable system, enabling network enumeration and fac...
CVE-2021-39048
CVE-2021-39048 affects IBM Spectrum Protect Client 7.1 and 8.1, with a stack-based buffer overflow due to improper bounds checking. Local attackers could cause a denial of service. Public sources (e.g., Gentoo GLSA 202209-02) indicate fixes are available: upgrade to IBM Spectrum Protect Client 7....
CVE-2021-39048
IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this vulnerability and cause a denial of service. IBM X-Force ID: 214438...
CVE-2021-38901
CVE-2021-38901 affects IBM Spectrum Protect Operations Center (7.1.x: 7.1.0.000–7.1.13.x). Under special configurations, a local user could obtain highly sensitive information; the issue stems from tracing exposing credentials in trace files (plain text). CVSS: vector and scores indicate a MEDIUM...
CVE-2021-38901
IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610...
CVE-2020-4496
The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046...
CVE-2020-4496
IBM Spectrum Protect Plus (IBM Spectrum Protect Plus server connected to a workload agent) is affected by CVE-2020-4496: MITM due to improper certificate validation in versions 10.1.0.0–10.1.8.x. The IBM security bulletin lists a fix in Spectrum Protect Plus 10.1.9 (Linux) and notes remediation/w...
CVE-2021-39052
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523...
CVE-2021-39065
IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could...