CVE-2022-22487

IBM Spectrum Protect Server and its storage agent are affected by CVE-2022-22487, a brute-force login flaw that allows unlimited login attempts to the storage agent without locking the admin ID. This enables a remote attacker to potentially gain unauthorized administrative access to both the stor...

CVE-2022-22478

IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886...

CVE-2022-22478

IBM Spectrum Protect Client 8.1.0.0–8.1.14.0 stores user credentials in plaintext readable by a local user, constituting information disclosure (CVE-2022-22478). IBM’s bulletin notes a fix in version 8.1.15 (Backup-Archive/Space Management components affected). CVSSv3 base score reported as 6.2 (...

CVE-2022-22474

Summary: CVE-2022-22474 affects IBM Spectrum Protect Client components dsmcad, dsmc, and dsmcsvc (IBM Spectrum Protect 8.1.0.0–8.1.14.0). The issue arises from how read operations on TCP/IP sockets are handled, which can lead to a denial-of-service condition for client operations. Affected versio...

CVE-2022-22474

IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348...

Security Bulletin: Vulnerability in PostgreSQL may affect IBM Spectrum Protect Plus

Summary PostgreSQL could allow a remote attacker to gain unauthorized access to the system which may affect IBM Spectrum Protect Plus. Vulnerability Details IBM X-Force ID: 220313 DESCRIPTION: PostgreSQL JDBC Driver could allow a remote attacker to gain unauthorized access to the system, caused b...

Security Bulletin: Vulnerabilities in Samba, OpenSSL, Python, and XStream affect IBM Spectrum Protect Plus (CVE-2021-20254, CVE-2021-3712, CVE-2021-43859, CVE-2022-0778, CVE-2020-25717, CVE-2021-23192, CVE-2021-3733)

Summary Vulnerabilities in Samba, OpenSSL, Python, and XStream may affect IBM Spectrum Protect Plus. These vulnerabilities include bypassing security restrictions, obtaining sensitive information, denial of service, and elevation of privileges. Vulnerability Details CVEID: CVE-2021-20254...

IBM Spectrum Protect 授权问题漏洞

IBM Spectrum Protect is a suite of data protection platforms from IBM Corporation in the United States. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect...

IBM Spectrum Protect Plus 安全漏洞

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM Corporation in the United States. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum...

IBM Spectrum Protect Server 安全特征问题漏洞

IBM Spectrum Protect Server is a spectrum protection system from IBM USA, Inc. providing comprehensive data resiliency for physical file servers, virtual environments, and a wide range of applications.IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14 have a security feature issue...

IBM Spectrum Protect Operations Center 安全漏洞

IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control for the IBM Spectrum Protect environment. IBM Spectrum Protect Operations Center versions 8.1.0.000 through 8.1.14 versions contain an information disclosure vulnerability that can be exploited by an...

IBM Spectrum Protect 安全漏洞

IBM Spectrum Protect is a suite of data protection platforms from IBM USA. The platform provides enterprises with a single point of control and management, and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Client has an information...

IBM Spectrum Protect 安全漏洞

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protec...

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Summary There are multiple vulnerabilities in the Linux Kernel that affect IBM Spectrum Protect Plus. These vulnerabilities include elevation of privileges, obtaining sensitive information, denial of service, execution of arbitrary code on the system, bypassing security restrictions, and buffer...

Security Bulletin: IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift vulnerable to login security bypass (CVE-2022-22472)

Summary BM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift is vulnerable to login security being bypassed which can result in gaining unauthorized access to the IBM Spectrum Protect Plus Server. Vulnerability Details CVEID:CVE-2022-22472 DESCRIPTION: IBM...

Security Bulletin: Vulnerabilities in Golang Go and MinIO may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift (CVE-2022-24842,CVE-2021-38561,CVE-2021-43565,CVE-2022-28327,CVE-2022-24675,CVE-2022-27536)

Summary Vulnerabilities in Golang Go and MinIO such as denial of service and elevated privileges may affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and Red Hat OpenShift. Vulnerability Details CVEID:CVE-2022-24842 DESCRIPTION: MinIO could allow a remote authenticated...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2021-35550, CVE-2021-35603)

Summary Vulnerabilities in IBM® Runtime Environment Java™ were disclosed as part of the IBM Java SDK updates in October 2021. IBM® Runtime Environment Java™, used by IBM Spectrum Protect Operations Center and Client Management Service, may be affected by the below vulnerabilities CVEs...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Operations Center (CVE-2022-22494)

Summary IBM Spectrum Protect Operations Center may disclosure database information in error messages sent to the user which could be used in future attacks. Vulnerability Details CVEID:CVE-2022-22494 DESCRIPTION: IBM Spectrum Protect Operations Center could allow a remote attacker to gain details...

Security Bulletin: IBM Spectrum Protect Server vulnerable to offline dictionary and brute force attacks (CVE-2022-22496, CVE-2022-22487)

Summary The IBM Spectrum Protect Server is vulnerable to an offline dictionary attack when using SESSIONSECURITY=TRANSITIONAL. The IBM Spectrum Protect Storage agent is vulnerable to a brute force attack by allowing unlimited attempts to login to the storage agent without locking the administrati...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Server (CVE-2021-35550, CVE-2021-35603)

Summary Vulnerabilities in IBM® Runtime Environment Java™ were disclosed as part of the IBM Java SDK updates in October 2021. IBM® Runtime Environment Java™ is used by IBM Spectrum Protect Server and may be affected by the below vulnerabilities CVEs. Vulnerability Details CVEID: CVE-2021-35603...