Security Bulletin: IBM Spectrum Copy Data Management is vulnerable to bypassing authentication, information disclosure, XSS, CSRF, and reverse tabnabbing

Summary IBM Spectrum Copy Data Management is vulnerable to bypassing authentication restrictions, information disclosure due to an unnecessary open port, cross-site scripting XSS, cross-site request forgery CSRF, and reverse tabnabbing. Vulnerability Details CVEID:CVE-2022-22426 DESCRIPTION: IBM...

Security Bulletin: Vulnerabilities in Golang Go, OpenSSL, Python, and XStream affect IBM Spectrum Copy Data Management

Summary Vulnerabilities in Golang Go, OpenSSL, Python, and XStream, such as bypassing security restrictions and denial of service, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an...

Security Bulletin: Vulnerabilities in the Linux Kernel affect IBM Spectrum Copy Data Management

Summary Linux Kernel vulnerabilities, such as obtaining sensitive information, bypassing security restrictions, denial of service, elevation of privileges, and execution of arbitrary code on the system, may affect IBM Spectrum Copy Data Management. Vulnerability Details CVEID:CVE-2022-0850...

CVE-2022-22479

IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 225887...

CVE-2022-30611

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using some fields of the form in the portal UI to inject malicious script into a Web page whic...

CVE-2022-30610

IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Onc...

IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2022-60418)

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus is vulnerable to an informati...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

Design/Logic Flaw

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

CVE-2022-22396

CVE-2022-22396 affects IBM Spectrum Protect Plus 10.1.0.0–10.1.9.3, where credentials may be disclosed in plaintext in the virgo log file in certain operations (remote vSnap, offload targets, or VADP credentials). API-key or certificate credentials are not printed. The issue’s root cause is infor...

IBM Spectrum Protect和IBM Spectrum Protect Plus 路径遍历漏洞

IBM Spectrum Protect Plus is a data protection platform from IBM USA. The platform provides enterprises with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. IBM Spectrum Protect Plus is vulnerable to an informati...

Vulnerability fixed in IBM Spectrum Protect Plus

IBM has fixed a vulnerability in Spectrum Protect Plus. Credentials of users are printed in readable text in the IBM Spectrum Protect Plus virgo log file. IBM has released updates to fix the vulnerabilities in Spectrum Protect Plus 10.1.0.0-10.1.9.32. For more information, see:...

Security Bulletin: IBM Spectrum Protect Plus may disclose sensitive information in virgo log file (CVE-2022-22396)

Summary IBM Spectrum Protect Plus may disclose credentials in clear text in the virgo log file. Vulnerability Details CVEID:CVE-2022-22396 DESCRIPTION: Credentials are printed in clear text in the IBM Spectrum Protect Plus virgo log file in certain cases. Credentials could be the remote vSnap,...

CVE-2022-22396

Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow an attacker to decrypt highly sensitive information(CVE-2022-22368)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow an attacker to decrypt highly sensitive information. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2022-22368 DESCRIPTION: IBM Spectrum Scale uses weaker than...

Security Bulletin: Multiple vulnerabilities in Apache Log4j affect IBM Cloud Pak System

Summary Multple vulnerabilities exist in Apache log4j that could allow someone to execute arbitrary code on the system. Apache Log4j v1 is used by Cloud Pak System in order to generate logs and diagnostic traces in some of its components; IBM DB2 , IBM Tivoli Monitoring, IBM Spectrum Scale and IB...

Security Bulletin: Vulnerability in OpenSSL affects IBM Spectrum Control (CVE-2022-1292)

Summary A vulnerability in OpenSSL could allow an attacker to execute arbitrary commands on the system. This vulnerability may affect IBM Spectrum Control due to its use of OpenSSL in the Storage Resource Agent component and XIV storage probe. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION...

Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE

Summary Vulnerabilities in XStream, Apache Xerces2, Jackson, OpenSSL, and Java SE such as execution of arbitrary code, denial of service, server-side request forgery, amd weaker than expected security may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-4160 DESCRIPTION: OpenSSL...