CVE-2020-4206

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper validation of user-supplied input. IBM X-Force ID: 174966...

Input validation

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper validation of user-supplied input. IBM X-Force ID: 174966...

Hardcoded credentials

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

Design/Logic Flaw

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...

Input validation

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied input. IBM X-Force ID: 175026...

Cross site request forgery (csrf)

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to overwrite or create arbitrary files on the system. IBM X-Force ID: 175417...

Design/Logic Flaw

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...

CVE-2020-4242

CVE-2020-4242 affects IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0–10.1.5. The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM’s Security Bulletin (and related IBM X-Force data) confirms a command-inje...

CVE-2020-4242

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...

EUVD-2020-25488

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...

CVE-2020-4241

IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...

CVE-2020-4241

CVE-2020-4241 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. A command injection exists due to lack of input validation in the Administrative Console’s uploadHttpsCertificate filename parameter, enabling a remote authenticated attacker to execute arbitrary commands on the target system. Connect...

CVE-2020-4240

IBM Spectrum Protect Plus 10.1.0–10.1.5 is affected by a path traversal vulnerability that enables a remote attacker to overwrite or create arbitrary files via a specially crafted URL/request. The root cause cited across sources is improper validation of a user-supplied path in the Administrative...

CVE-2020-4240

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to overwrite or create arbitrary files on the system. IBM X-Force ID: 175417...

CVE-2020-4214

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied input. IBM X-Force ID: 175026...

CVE-2020-4214

CVE-2020-4214 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. It is caused by improper validation of user-supplied input, allowing a remote attacker to remotely delete directories. The IBM bulletin lists the affected product, versions, and impact (arbitrary directory deletion). Remediation: appl...

CVE-2020-4208

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

CVE-2020-4208

CVE-2020-4208 affects IBM Spectrum Protect Plus 10.1.0–10.1.5, where hard-coded credentials are used for inbound authentication, outbound communication, or internal data encryption. The root cause is hard-coded credentials in the product, leading to exposure of authentication and potential unauth...

CVE-2020-4206

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper validation of user-supplied input. IBM X-Force ID: 174966...

CVE-2020-4206

CVE-2020-4206 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. A remote attacker can execute arbitrary commands as root due to improper validation of user-supplied input. This is supported by multiple sources in the connected set (IBM X-Force, IBM security bulletin). Remediation per the IBM bulle...