CVE-2020-4469

IBM Spectrum Protect Plus 10.1.0–10.1.5 is affected by a remote code execution via hostname command injection. The issue stems from improper validation of the hostname parameter in the HTTP request to the Administrative Console Framework, allowing unauthenticated, remote attackers to execute arbi...

CVE-2020-4216

CVE-2020-4216 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.5 due to hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. This leads to an authentication bypass vulnerability. The IBM advisory lists a first-fix in 10.1.6 for Spectru...

CVE-2020-4216

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 175066...

Security Bulletin: Denial of Service vulnerability in Linux Kernel affects IBM Spectrum Protect Plus (CVE-2020-12114)

Summary There is a denial of service vulnerability in the Linux Kernel that affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-12114 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a pivotroot race condition in fs/namespace.c. By corrupting a...

IBM Spectrum Protect Plus Code Execution Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-33088)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Information Disclosure Vulnerability (CNVD-2020-33085)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from IBM in the United States. The platform provides organizations with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of...

IBM Spectrum Protect Plus File Upload Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Denial of Service Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2020-33087)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Clickjacking Vulnerability

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from IBM in the United States. The platform provides organizations with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of...

IBM Spectrum Protect Plus Hardcoded Username And Password Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of login requests to the Discovery Server service. The product...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Operations Center and Client Management Service

Summary There are multiple vulnerabilities in IBM WebSphere Application Server Liberty that affect IBM Spectrum Protect Operations Center and Client Management Service. Vulnerabilities include spoofing attacks, security bypass, denial of service, and information disclosure. Vulnerability Details...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-4732, CVE-2019-2989, CVE-2019-2964)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. These issues were disclosed as part of the IBM Java SDK updates in October 2019 and January 2020. Vulnerability...

Security Bulletin: Vulnerability in IBM Java Runtime affects the IBM Spectrum Protect Server (CVE-2019-2989)

Summary A vulnerability exists in IBM Runtime Environment Java which is used by the IBM Spectrum Protect Server. This issue was disclosed as part of the IBM Java SDK updates in October 2019. Vulnerability Details CVEID: CVE-2019-2989 DESCRIPTION: An unspecified vulnerability in Java SE could allo...

Security Bulletin: Vulnerability in Go programming language affects IBM Spectrum Protect Server (CVE-2019-16276)

Summary The Go programming language could allow a remote attacker to bypass security restrictions which affects the IBM Spectrum Protect Server. Vulnerability Details CVEID: CVE-2019-16276 DESCRIPTION: Golang could allow a remote attacker to bypass security restrictions, caused by improper...

Security Bulletin: Vulnerabilities in Dojo affect IBM Spectrum Protect Operations Center (CVE-2020-5259, CVE-2020-5258)

Summary Dojo could allow a remote attacker to inject arbitrary code on the system which affects IBM Spectrum Protect Operations Center. Vulnerability Details CVEID: CVE-2020-5259 DESCRIPTION: Dojo dojox could allow a remote attacker to inject arbitrary code on the system, caused by a prototype...

Security Bulletin: IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management web user interface vulnerable to authentication bypass and clickjacking (CVE-2020-4494, CVE-2020-4406)

Summary The web user interface provided by the IBM Spectrum Protect Client and IBM Spectrum Protect for Space Management is vulnerable to authentication bypass and a clickjacking attack. Vulnerability Details CVEID: CVE-2020-4494 DESCRIPTION: The IBM Spectrum Protect Backup-Archive Client web use...

Security Bulletin: Information Disclosure via IBM Spectrum Protect Plus virgo log file (CVE-2020-4477)

Summary IBM Spectrum Protect Plus virgo log file may disclose sensitive information in plain text. Vulnerability Details CVEID: CVE-2020-4477 DESCRIPTION: IBM Spectrum Protect Plus discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks...

Security Bulletin: IBM Spectrum Protect Plus vulnerable to Logjam (CVE-2015-4000)

Summary A port used by VADP is reported to be vulnerable to Logjam CVE-2015-4000. Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a DHEEXPORT ciphersuite choice. An...