CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

Information disclosure

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Hardcoded credentials

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4854

IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...

CVE-2020-4783

CVE-2020-4783 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. Root cause: failure to properly enable HTTP Strict Transport Security, enabling information disclosure via man-in-the-middle. Impact: remote attacker could obtain sensitive information over network (TLS/HTTPS). Affected produ...

CVE-2020-4783

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2020-4854

IBM Spectrum Protect Plus versions 10.1.0–10.1.6 contain hard-coded credentials used for inbound authentication, outbound communication, or data encryption, representing a high-severity vulnerability (CVSS v3.1 score up to 9.8) with network exposure. The root cause is embedded credentials in the ...

Security Bulletin: Vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-5408 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to obtain...

Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft Windows File Systems agent (CVE-2020-15801)

Summary There is a vulnerability in Python that could allow a local attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability Details CVEID: CVE-2020-15801 DESCRIPTION: Python could allow a...

Security Bulletin: IBM Spectrum Protect Plus allows use of TLS Version 1.1 protocols (CVE-2020-4783)

Summary IBM Spectrum Protect Plus should disable the use of TLS Version 1.1 protocols as this could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4783 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to obtain sensitive...

IBM Spectrum Protect Plus 信息泄露漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 through 10.1.6. The...

IBM Spectrum Protect Plus 信任管理问题漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A hard-coded credentials vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can...

IBM Spectrum Protect Plus File Upload RCE

The IBM Spectrum Protect Plus SPP administrative console running on the remote host is affected by a remote code execution vulnerability due to the fact that it allows remote installation of console plugins. An unauthenticated, remote attacker can exploit this and CVE-2020-4711 together, via...

IBM Spectrum Protect Plus Directory Traversal (CVE-2020-4711)

A directory traversal vulnerability exists in IBM Spectrum Protect Plus. Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information from the affected server...

IBM Spectrum Protect Plus Directory Traversal Vulnerability

IBM Spectrum Protect Plus is a data protection platform. A directory traversal vulnerability exists in IBM Spectrum Protect Plus, which can be exploited by a remote attacker to submit a special request to read system files in an application context...

IBM Spectrum Protect Plus Path Traversal Vulnerability (CNVD-2020-52457)

IBM Spectrum Protect formerly known as Tivoli Storage Manager and IBM Spectrum Protect Plus are both products of IBM Corporation, U.S.A. IBM Spectrum Protect is a data protection platform. IBM Spectrum Protect is a data protection platform that provides organizations with a single point of contro...

IBM Spectrum Protect Plus Path Traversal Vulnerability (CNVD-2020-52458)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus suffers from a pa...

IBM Spectrum Protect Plus Security Open to RCE

IBM has issued fixes for vulnerabilities in Spectrum Protect Plus, Big Blue’s security tool found under the umbrella of its Spectrum data storage software branding. The flaws can be exploited by remote attackers to execute code on vulnerable systems. IBM Spectrum Protect Plus is a data-protection...

CVE-2020-4711

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 187501...