CVE-2020-5017

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653...

CVE-2020-5020

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further...

CVE-2020-5018

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an attacker. IBM X-Force ID: 193654...

CVE-2020-5021

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system. IBM X-Force ID: 193657...

IBM HTTP Server 7.0.0.0 <= 7.0.0.43 / 8.0.0.0 <= 8.0.0.14 / 8.5.0.0 < 8.5.5.14 / 9.0.0.0 < 9.0.0.8 Multiple Vulnerabilities (569301)

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, including the following: - IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which cou...

Security Bulletin: Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Suite for HPA

Summary Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Suite for HPA. IBM Spectrum LSF Suite for HPA has addressed these issues. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products...

Security Bulletin: Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Suite

Summary Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Suite. IBM Spectrum LSF Suite has addressed these issues. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|-...

Security Bulletin: Vulnerabilities in codemirror affect Spectrum LSF Application Center

Summary There are vulnerabilities in codemirror used by IBM Spectrum LSF Application Center. IBM Spectrum LSF Application Center has addressed these issues. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Explorer

Summary Public disclosed vulnerabilities from codemirror affect IBM Spectrum LSF Explorer. IBM Spectrum LSF Explorer has addressed these vulnerabilities. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

Security Bulletin: A vulnerability in IBM Spectrum Scale packaged in IBM Elastic Storage Server could cause a denial of service (CVE-2020-4756)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server that could allow a local attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4756 DESCRIPTION: IBM Spectrum Scale V4.2.0.0 through...

Security Bulletin: Multiple vulnerabilities affect the IBM Elastic Storage System GUI

Summary Vulnerabilities exist in all levels of IBM Elastic Storage System GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4748 DESCRIPTION: IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe...

Security Bulletin: Denial of Service Vulnerability in Chart.js affects IBM Spectrum Protect Plus (CVE-2020-7746)

Summary The Node.js chart.js module is vulnerable to a denial of service which may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-7746 DESCRIPTION: Node.js chart.js moudle is vulnerable to a denial of service, caused by a prototype pollution flaw when processing the optio...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect for Workstations Central Administration Console

Summary IBM Spectrum Protect for Workstations Central Administration Console requires the dependent product IBM WebSphere Application Server Liberty. Information about security vulnerabilities affecting IBM WebSphere Application Server Liberty has been published in security bulletins. Vulnerabili...

Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137)

Summary Urllib3 is vulnerable to CRLF injection which could allow a remote attacker to perform cross-site scripting, cache poisoning, or session hijacking attacks. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsof...

Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747)

Summary There is a vulnerability in PyYAML that could allow a remote attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Plus Container agent for Kubernetes and the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability...

Security Bulletin: Improper Authentication of Websocket Endpoint in IBM Spectrum Protect Operations Center

Summary Improper authentication of a websocket endpoint in IBM Spectrum Protect Operations Center could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4771 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a remote attacker to obtain...

Vulnerability fixed in IBM Spectrum Protect Operations Center

IBM has fixed a vulnerability in Spectrum Protect Operations Center. A malicious person with network access to the system could potentially exploit the vulnerability potentially exploit it to obtain information about the system. IBM has released updates to fix the vulnerability in Spectrum Protec...

IBM Spectrum Protect Plus Hardcoded Credentials Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A hard-coded credentials vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-66199)

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 through 10.1.6. The...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...