CVE-2020-4711

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 187501...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 187501...

Design/Logic Flaw

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. This vulnerability is due to an incomplete fix for CVE-2020-4470. IBM X-Force ID: 187188...

CVE-2020-4711

CVE-2020-4711 affects IBM Spectrum Protect Plus 10.1.0–10.1.6. The issue is a directory traversal vulnerability in a script (restore_wrapper.sh) accessed via the unauthenticated endpoint /catalogmanager/api/catalog (cmode=restorefromjob). A missing/ bypassable path check allows an unauthenticated...

CVE-2020-4703

CVE-2020-4703 affects IBM Spectrum Protect Plus 10.1.0–10.1.6 (Administrative Console). The issue allows an authenticated attacker to upload arbitrary files, which could be used to execute arbitrary code on the vulnerable server. It stems from an incomplete fix for CVE-2020-4470. Exploitation req...

CVE-2020-4711

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 187501...

CVE-2020-4703

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. This vulnerability is due to an incomplete fix for CVE-2020-4470. IBM X-Force ID: 187188...

Vulnerabilities fixed in IBM Spectrum Protect

Vulnerabilities have been fixed in IBM Spectrum Protect. The vulnerabilities allow a malicious party to execute arbitrary code execute arbitrary code and gain access to system data. IBM has released updates to fix the vulnerabilities. More information can be found on the page below:...

Security Bulletin: Linux Kernel vulnerability affects IBM Spectrum Protect Plus (187206)

Summary Vulnerability in the Linux Kernel affects IBM Spectrum Protect Plus. Vulnerability Details Third Party Entry: 187206 DESCRIPTION: Linux Kernel copy-on-write security bypass CVSS Base score: 6.2 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/187206 for the...

Security Bulletin: Docker vulnerability affects IBM Spectrum Protect Plus (CVE-2020-13401)

Summary Docker is vulnerable to a man-in-the-middle attack which could affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-13401 DESCRIPTION: Docker Docker CE is vulnerable to a man-in-the-middle attack, caused by improper validation of router advertisements. By sending rogue...

Security Bulletin: Directory Traversal and Execution of Arbitrary Code vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4711, CVE-2020-4703)

Summary IBM Spectrum Protect Plus is vulnerable to directory traversal and execution of arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4711 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to traverse directories on the system. An attacker could send a...

Security Bulletin: IBM® Db2® on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2020-4412)

Summary The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale mmfsd/mmsdrserv daemons to unexpectedly exit, impacting the functionality of the Spectrum Scale...

Security Bulletin: IBM® Db2® on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2020-4411)

Summary The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service vulnerability in its kernel module that could allow an attacker to cause a denial of service condition on the affected system. To exploit this vulnerability, a...

CVE-2020-15790

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...

CVE-2020-15790

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...

CVE-2020-15784

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. Insecure storage of sensitive information in the configuration files could allow the retrieval of user names...

CVE-2020-15784

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. Insecure storage of sensitive information in the configuration files could allow the retrieval of user names...

Information disclosure

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. Insecure storage of sensitive information in the configuration files could allow the retrieval of user names...

Design/Logic Flaw

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...

CVE-2020-15790

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP8. If configured in an insecure manner, the web server might be susceptible to a directory listing attack...