CVE-2020-5023

IBM Spectrum Protect Plus (10.1.0–10.1.7) is vulnerable to CVE-2020-5023: a remote attacker can inject arbitrary data, potentially causing the service to crash from excessive resource use. Affected versions are 10.1.0 through 10.1.7. The issue stems from arbitrary data injection/parameter fuzzing...

Security Bulletin: Denial of Service vulnerability in IBM Spectrum Protect Plus (CVE-2020-5023)

Summary IBM Spectrum Protect Plus may be vulnerable to a denial of service attack when arbitrary data injection/parameter fuzzing is performed. Vulnerability Details CVEID: CVE-2020-5023 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote user to inject arbitrary data iwhich could cause t...

Security Bulletin: Vulnerabilities in Node.js and FasterXML jackson-databind affect IBM Spectrum Protect Plus

Summary Multiple vulnerabilities in Node.js and FasterXML jackson-databind may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-25649 DESCRIPTION: FasterXML Jackson Databind could provide weaker than expected security, caused by not having entity expansion secured properly....

Security Bulletin: Vulnerabilities in psutil, python, and Golang affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift

Summary Vulnerabilities in psutil, python and Golang Go may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift. Vulnerability Details CVEID: CVE-2019-18874 DESCRIPTION: psutil is vulnerable to a denial of service, caused by a double free. By using...

Security Bulletin: Vulnerability in psutil affects IBM Spectrum Protect Plus backup and restore of Db2 and MongoDB databases (CVE-2019-18874)

Summary Denial of service vulnerability in psutil may affect IBM Spectrum Protect Plus backup and restore of Db2 and MongoDB databases. Vulnerability Details CVEID: CVE-2019-18874 DESCRIPTION: psutil is vulnerable to a denial of service, caused by a double free. By using specially-crafted data, a...

CVE-2020-5023

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resource consumption. IBM X-Force ID: 193659...

IBM Spectrum Protect Plus 资源管理错误漏洞

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A denial of service vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.7. A remote user can exploit...

Qualcomm SnapDragon Smart Protect Buffer Error Vulnerability

Qualcomm SnapDragon Smart Protect is a Qualcomm component that provides real-time security for devices. The technology uses machine learning to analyze behavior and protect devices from vulnerabilities in real time. Qualcomm SnapDragon Smart Protect suffers from a security vulnerability that stem...

Security Bulletin: IBM Java Runtime Vulnerabilities affect the IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary Vulnerabilities in IBM® Runtime Environment Java™ such as denial of service and ability to obtain sensitive information could affect the IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Envionments. These...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary A vulnerability IBM WebSphere Application Server Liberty could allow an attacker to obtain sensitive information. This vulnerability may affect the IBM Spectrum Protect Backup-Archive Client web user interface, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtua...

Why Data Privacy Day matters

Our Lock and Code special episode on Data Privacy Day, featuring guests from Mozilla, DuckDuckGo, and Electronic Frontier Foundation can be listened to here. Today, January 28, is Data Privacy Day, the annual, multinational event in which governments, companies, and schools can inform the public...

Trend Micro Serverprotect for Linux 资源管理错误漏洞

Trend Micro Serverprotect for Linux is an antivirus program for enterprise environments from Trend Micro, USA. A memory exhaustion vulnerability exists in the manual scanning component of Trend Micro ServerProtect for Linux. A local attacker could exploit this vulnerability via specially crafted...

CVE-2021-1067

NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges...

CVE-2021-1067

NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges...

Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft File Systems Agent (CVE-2020-26116)

Summary Python is vulnerable to CRLF injection which affects the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability Details CVEID: CVE-2020-26116 DESCRIPTION: Python is vulnerable to CRLF injection, caused by improper validation of user-supplied input in http.client. B...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2021-03005)

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker could...

IBM Spectrum Protect Plus Session Fixation Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A session fixation vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability stems fr...

IBM Spectrum Protect Plus HTTP Header Injection Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An HTTP header injection vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. The vulnerability...

IBM Spectrum Protect Plus Clickjacking Vulnerability

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A clickjacking vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can exploit this...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2021-03029)

IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0-10.1.6. An attacker can explo...