CVE-2020-4358

CVE-2020-4358 affects IBM Spectrum Scale 5.0.0.0 through 5.0.4.4, where the Web UI is vulnerable to cross-site scripting, enabling injection of arbitrary JavaScript that can lead to credentials disclosure within a trusted session. IBM Security Bulletins for Spectrum Scale GUI and ESS cite a fix: ...

CVE-2020-4357

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761...

CVE-2020-4350

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424...

CVE-2020-4357

Summary of CVE-2020-4357 details (from connected IBM/Spectrum Scale sources): IBM Spectrum Scale and the IBM Spectrum Scale GUI are affected by verbose/error disclosure where detailed technical error messages returned in the browser can reveal sensitive information. Affected products/versions inc...

CVE-2020-4350

CVE-2020-4350 affects IBM Spectrum Scale (and related IBM ESS/GUIs) versions 5.0.0.0 through 5.0.4.4, where weaker cryptographic algorithms could allow decryption of highly sensitive data. Connected IBM advisories specify the affected products and versions, with remediations: IBM Spectrum Scale G...

CVE-2020-4348

IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414...

CVE-2020-4349

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178423...

CVE-2020-4348

CVE-2020-4348 affects IBM Spectrum Scale GUI components: versions 4.2.0.0–4.2.3.21 and 5.0.0.0–5.0.4.4 allow an authenticated GUI user to perform unauthorized actions due to missing function-level access control. Documents from IBM Security Bulletins identify affected products and fixes: Spectrum...

CVE-2020-4349

CVE-2020-4349 : IBM Spectrum Scale (GPFS) 5.0.0.0–5.0.4.4 uses weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM references the vulnerability in multiple advisories for ESS/Spectrum Scale GUI and ESS 3000, with affected products including IB...

PT-2020-18023

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0.0 through 5.0.4.4 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2020-4379: Use of a Broken or Risky Cryptographic Algorithm

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158...

CVE-2020-4378: Undefined Security Weakness

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157...

IBM Spectrum Scale Unauthorized Operation Vulnerability (CNVD-2020-34638)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

PT-2020-18018

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0.0 through 5.0.4.4 Description The issue is related to the use of weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. Recommendations For IBM...

IBM Spectrum Scale Unauthorized Operation Vulnerability

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

CVE-2020-4348: Missing Authorization

IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414...

CVE-2020-4358: Improper Neutralization of Input During Web Page Generation

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17876...

IBM Spectrum Scale Information Disclosure Vulnerability (CNVD-2020-30834)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

IBM Spectrum Scale Encryption Problem Vulnerability (CNVD-2020-30835)

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

PT-2020-18022

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 5.0.0.0 through 5.0.4.4 Description A remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser, which could be used in further attacks against the system...