3708 matches found
Authentication flaw
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream, an attacker could...
CVE-2020-4854
IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...
CVE-2020-4783
CVE-2020-4783 affects IBM Spectrum Protect Plus versions 10.1.0–10.1.6. Root cause: failure to properly enable HTTP Strict Transport Security, enabling information disclosure via man-in-the-middle. Impact: remote attacker could obtain sensitive information over network (TLS/HTTPS). Affected produ...
CVE-2020-4854
IBM Spectrum Protect Plus versions 10.1.0–10.1.6 contain hard-coded credentials used for inbound authentication, outbound communication, or data encryption, representing a high-severity vulnerability (CVSS v3.1 score up to 9.8) with network exposure. The root cause is embedded credentials in the ...
CVE-2020-4783
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...
CVE-2020-4771
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream, an attacker could...
CVE-2020-4771
IBM Spectrum Protect Operations Center contains a vulnerability (CVE-2020-4771) where improper authentication of a websocket endpoint could allow a remote attacker to obtain sensitive information by subscribing to the websocket event stream. Affected versions are IBM Spectrum Protect Operations C...
IBM Spectrum Protect Operations Center Information Disclosure Vulnerability (CNVD-2020-67638)
IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control for IBM Spectrum Protect environments. IBM Spectrum Protect Operations Center suffers from a sensitive information disclosure vulnerability caused by a failure to properly authenticate a websocket...
Security Bulletin: Vulnerabilities in IBM Java Runtime, IBM WebSphere Application Server Liberty, and Apache Commons affect IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service
Summary Vulnerabilities in IBM® Runtime Environment Java™, IBM WebSphere Application Server Liberty, and Apache Commons affect IBM Spectrum Protect Operations Center and IBM Spectrum Protect Client Management Service. The Java vulnerabilities were disclosed as part of the IBM Java SDK updates in...
Security Bulletin: IBM Spectrum Protect Server allows Triple DES (3DES) ciphers to be used (CVE-2018-1785)
Summary IBM Spectrum Protect Server allows Triple DES 3DES ciphers to be used. This can result in the use of weaker than expected cryptographic algorithms. Vulnerability Details CVEID: CVE-2018-1785 DESCRIPTION: IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 uses weaker than expected...
Security Bulletin: Vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus
Summary Multiple vulnerabilities in jQuery, Spring, Dom4j, MongoDB, Linux Kernel, Targetcli-fb, Jackson, Node.js, and Apache Commons affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-5408 DESCRIPTION: VMware Tanzu Spring Security could allow a remote attacker to obtain...
Security Bulletin: Vulnerability in Python affects IBM Spectrum Protect Plus Microsoft Windows File Systems agent (CVE-2020-15801)
Summary There is a vulnerability in Python that could allow a local attacker to execute arbitrary code on the system. This vulnerability may affect the IBM Spectrum Protect Plus Microsoft® Windows File Systems agent. Vulnerability Details CVEID: CVE-2020-15801 DESCRIPTION: Python could allow a...
Security Bulletin: IBM Spectrum Protect Plus allows use of TLS Version 1.1 protocols (CVE-2020-4783)
Summary IBM Spectrum Protect Plus should disable the use of TLS Version 1.1 protocols as this could allow a remote attacker to obtain sensitive information. Vulnerability Details CVEID: CVE-2020-4783 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to obtain sensitive...
IBM Spectrum Protect Operations Center 授权问题漏洞
IBM Spectrum Protect Operations Center is a software from IBM USA that provides visual control for IBM Spectrum Protect environments. IBM Spectrum Protect Operations Center suffers from a sensitive information disclosure vulnerability caused by a failure to properly authenticate a websocket...
CVE-2020-4854
IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 190454...
IBM Spectrum Protect Plus 信息泄露漏洞
IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. An information disclosure vulnerability exists in IBM Spectrum Protect Plus 10.1.0 through 10.1.6. The...
IBM Spectrum Protect Plus 信任管理问题漏洞
IBM Spectrum Protect Plus is a data protection and availability solution for virtualized environments that can be deployed in minutes and protect your environment in less than an hour. A hard-coded credentials vulnerability exists in IBM Spectrum Protect Plus 10.1.0 - 10.1.6. An attacker can...
CVE-2020-4771
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitive information, caused by improper authentication of a websocket endpoint. By using known tools to subscribe to the websocket event stream, an attacker could...
CVE-2020-4783
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...
Security Bulletin: a security update of the google oauth client library to version 1.31.0 for CVE-2020-7692.
Summary This fix is a security update of the google oauth client library to version 1.31.0 for CVE-2020-7692. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Spectrum LSF| 10.1...