3952 matches found
Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2018-1685, CVE-2018-1710, CVE-2018-1711, CVE-2018-1780, CVE-2018-1781, CVE-2018-1799, CVE-2018-1802, CVE-2018-1834, CVE-2018-1857, CVE-2018-1897)
Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities. These Db2 vulnerabilities could allow a local user to gain elevated privileges, read any file on the system, or execute arbitrary code on the system. UPDATED 6/28/2019: Added 7...
Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server
Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities that could allow local users to overwrite files owned by the Db2 instance owner, execution of arbitrary code on the system, or an elevation of privileges. UPDATED 1/16/2019:...
Security Bulletin: Db2 vulnerability affects the IBM Spectrum Protect Server (CVE-2018-1448)
Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by an IBM Db2 vulnerability that could allow a local user to overwrite arbitrary files owned by the Db2 instance owner. UPDATED 1/16/2019: Changed "First Fixing VRM Level" in Remediation/Fixes table for 8.1 from...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2018-1890, CVE-2018-12547, CVE-2019-2426)
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center and IBM Spectrum Protect formerly Tivoli Storage Manager Client Management Service. These issues were disclosed as part of the IBM...
Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center (CVE-2019-4129)
Summary A stack trace may be displayed in error messages generated by IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center. Vulnerability Details CVEID: CVE-2019-4129 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a remote attacker to obtain sensitive informatio...
Security Bulletin: Potential Spoofing vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2018-1902)
Summary There is a potential spoofing vulnerability in IBM WebSphere Application Server Liberty which affects IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center. Vulnerability Details CVEID: CVE-2018-1902 DESCRIPTION: IBM WebSphere Application Server could allow a remote...
Security Bulletin: Password disclosure in IBM Spectrum Protect Server (CVE-2019-4140)
Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server may disclose the database restore password when using the dsmserv restore db command. This could allow another user to perform a database restore or possibly result in an old backup replacing the database. Vulnerability Detai...
Security Bulletin: Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2018-1922, CVE-2018-1923, CVE-2018-1936, CVE-2018-1978, CVE-2018-1980, CVE-2019-4014, CVE-2019-4015, CVE-2019-4016, CVE-2019-4094)
Summary The IBM Spectrum Protect formerly Tivoli Storage Manager Server is affected by multiple IBM Db2 vulnerabilities such as buffer overflow and loading binaries from an untrusted path. These Db2 vulnerabilities could allow execution of arbitrary code on the system or elevation of user...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect the IBM Spectrum Protect Server (CVE-2018-1890, CVE-2018-12547, CVE-2019-2426)
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by the IBM Spectrum Protect formerly Tivoli Storage Manager Server. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID: CVE-2018-1890 DESCRIPTION: I...
Security Bulletin: Cross-site scripting and privilege escalation vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect Operations Center (CVE-2018-1767, CVE-2018-1901)
Summary IBM WebSphere Application Server Liberty is vulnerable to cross-site scripting and escalation of privileges which can affect IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center. Vulnerability Details CVEID: CVE-2018-1767 DESCRIPTION: IBM WebSphere Application Server...
Security Bulletin: Privilege escalation and code injection vulnerabilities in IBM Spectrum Protect Plus application protection (CVE-2019-4383, CVE-2019-4357)
Summary IBM Spectrum Protect Plus application protection could allow a local attacker to gain elevated privileges or execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2019-4383 DESCRIPTION: When using Spectrum Protect Plus to protect Oracle or MongoDB databases, a redirected...
Security Bulletin: Speculative Store Bypass (SSB) vulnerability also known as SpectreNG or Variant 4 affects IBM Spectrum Protect Plus (CVE-2018-3639)
Summary IBM Spectrum Protect Plus may be affected by the Speculative Storage Bypass SSB vulnerability which is also known as SpetreNG or Variant 4. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU''s could allow a local attacker to obtain sensitive information, caused by...
Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0739, CVE-2018-0737, CVE-2018-0732)
Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on March 27, 2018, April 16, 2018, and June 12, 2018. OpenSSL, used by IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of...
Inside the MSRC – Anatomy of a SSIRP incident
This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan SSIRP. In ourlast blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft tak...
CVE-2019-4385
IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...
Information disclosure
IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...
CVE-2019-4385
IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173...
CVE-2019-4385
IBM Spectrum Protect Plus 10.1.2 is affected by CVE-2019-4385, where the vSnap CIFS password can be exposed in the IBM Spectrum Protect Plus Joblog, leading to information disclosure of sensitive data and potentially access to vSnap. Affected versions are 10.1.2.219 through 10.1.2.303. The root c...
Security Bulletin: Password exposure via job log in IBM Spectrum Protect Plus (CVE-2019-4385)
Summary IBM Spectrum Protect Plus may display the vSNAP CIFS password in the Spectrum Protect Plus job log Vulnerability Details CVEID: CVE-2019-4385 DESCRIPTION: IBM Spectrum Protect Plus may display the vSnap CIFS password in the IBM Spectrum Protect Plus job log. This can result in an attacker...