CVE-2020-4212

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023...

CVE-2020-4210

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020...

CVE-2019-4703

Summary: CVE-2019-4703 affects IBM Spectrum Protect Plus. Versions 10.1.0–10.1.5 (and 10.5.0 per some sources) could allow an attacker with intimate knowledge of the system protecting Microsoft SQL or Microsoft Exchange to obtain highly sensitive information (e.g., user IDs and passwords). Techni...

CVE-2020-4210

IBM Spectrum Protect Plus versions 10.1.0–10.1.5 are affected by a remote code execution (command injection) vulnerability. The flaw exists in the Administrative Console Framework service and results from lack of proper validation of a user-supplied string before using it to execute a system call...

CVE-2019-4703

IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Information Disclosure Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14213)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14212)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14208)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

Security Bulletin: Command injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4210, CVE-2020-4213, CVE-2020-4222, CVE-2020-4212, CVE-2020-4211)

Summary Command injection vulnerabilities in IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4210 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. By...

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Summary There are multiple security vulnerabilities in the Linux Kernel that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-19532 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by multiple out-of-bound write conditions in HID drivers. CVSS Base...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2019-4703)

Summary The user id and password may be exposed in IBM Spectrum Protect Plus when protecting Microsoft SQL or Microsoft Exchange. Vulnerability Details CVEID: CVE-2019-4703 DESCRIPTION: IBM Spectrum Protect Plus, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Protect Plus (CVE-2019-14833, CVE-2019-14847, CVE-2019-10218)

Summary Security vulnerabilities in Samba affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-14833 DESCRIPTION: A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new...

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus (CVE-2019-12402).

Summary A denial of service vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm. By choosi...

Security Bulletin: Multiple vulnerabilities in FasterXML Jackson-databind affect IBM Spectrum Protect Plus (CVE-2019-16943, CVE-2019-16942, CVE-2019-17531, CVE-2019-17267, CVE-2019-14540, CVE-2019-16335, CVE-2019-14379, CVE-2019-14439)

Summary There are multiple security vulnerabilities in FasterXML Jackson-databind that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-16943 DESCRIPTION: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0735, CVE-2018-0734, CVE-2018-5407)

Summary OpenSSL vulnerabilities were discllossed by the OpenSSL Project in October and November of 2018. IBM Spectrum Protect Plus uses OpenSSL and has addressed the applicable CVEs. 20 February 2020 - Changed fixing level from 10.1.5 to 10.1.5 patch1. 21 February 2020 - Provided link to 10.1.5...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer

Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer. IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer have addressed the applicable CVEs. Vulnerability...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA

Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA. IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA have addressed the applicable CVEs. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Platform Symphony and IBM Spectrum Symphony

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 Service Refresh 5 Fix Pack 41 and earlier releases used by IBM Platform Symphony and IBM Spectrum Symphony. IBM Platform Symphony and IBM Spectrum Symphony have addressed the applicable CVEs. Vulnerability...