CVE-2020-4383

CVE-2020-4383 affects IBM Elastic Storage Server (Spectrum Scale) in ESS 5.3.0–5.3.6. An authenticated user can trigger a denial of service during deployment when configuring certain network services, due to the underlying issue described in the IBM security bulletin. The NVD entry notes a CVSS v...

CVE-2020-4382

CVE-2020-4382 affects IBM Spectrum Scale for IBM Elastic Storage Server (ESS) in 5.3.0–5.3.5 (and related ESS releases) by allowing an authenticated user to cause a denial of service during deployment or upgrade related to xcat services. IBM IBM ESS bulletins document a CVSS base score around 6.2...

CVE-2020-4382

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.5 could allow an authenticated user to cause a denial of service during deployment or upgrade pertaining to xcat services. IBM X-Force ID: 179163...

Security Bulletin: IBM Elastic Storage Server GUI is affected by cross-site scripting (CVE-2020-4358)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server GUI. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4358 DESCRIPTION: IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This...

Security Bulletin: A vulnerability in OpenJDK Java Runtime Environment (JRE) affect IBM Spectrum Conductor 2.4.1

Summary There is a vulnerability in OpenJDK Java Runtime Environment JRE used by IBM Spectrum Conductor 2.4.1. IBM Spectrum Conductor 2.4.1 has addressed the applicable vulnerability. Vulnerability Details Third Party Entry: 185972 DESCRIPTION: Oracle JDK and OpenJDK JavaFX code execution CVSS Ba...

IBM Elastic Storage Server Spectrum Scale Denial of Service Vulnerability

IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...

Security Bulletin: A vulnerability has been identified in IBM Elastic Storager Server where an attacker can cause a denial of service (CVE-2020-4383)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server that could allow an attacker to cause a denial of service. A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4383 DESCRIPTION: IBM Spectrum Scale for IBM Elastic Storage...

CVE-2020-4381

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

Design/Logic Flaw

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

CVE-2020-4381

IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162...

CVE-2020-4381

CVE-2020-4381 affects IBM Spectrum Scale for IBM Elastic Storage Server (ESS) versions 5.3.0–5.3.5. An authenticated user can cause a denial of service during deployment or upgrade if GUI-specific services are enabled. The IBM bulletin notes a fix is available: upgrade ESS to version 5.3.6 via Fi...

IBM Spectrum Virtualize Elevation of Privilege Vulnerability

IBM Spectrum Virtualize is a software-only storage product that supports software-defined storage to manage and protect massive amounts of data. An elevation of privilege vulnerability exists in IBM Spectrum Virtualize 8.3.1. A remote user authenticated via LDAP can exploit this vulnerability to...

Security Bulletin: Incorrect permissions on IBM Spectrum Protect Plus agent files (CVE-2020-4631)

Summary IBM Spectrum Protect Plus agent files on Windows have incorrect access permissions. Vulnerability Details CVEID: CVE-2020-4631 DESCRIPTION: IBM Spectrum Protect Plus agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which...

CVE-2020-4686

IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678...

CVE-2020-4686

IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678...

Code injection

IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678...

CVE-2020-4686

CVE-2020-4686 affects IBM Spectrum Virtualize (and related IBM Storage products) with a vulnerability in LDAP authentication that could let a remote, LDAP-authenticated user escalate privileges. Affected versions include IBM SAN Volume Controller and Storwize family on 8.3.1. The IBM Security Bul...

CVE-2020-4686

IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center and Client Management Service (CVE-2019-12406)

Summary IBM WebSphere Application Server Liberty is vulnerable to an Apache CXF denial of service which affects IBM Spectrum Protect Operations Center and Client Management Service. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by...

Security Bulletin: Db2 vulnerabilities affect IBM Spectrum Protect Server (CVE-2020-4230, CVE-2020-4135, CVE-2020-4204, CVE-2020-4200)

Summary The IBM Spectrum Protect Server is affected by multiple Db2 vulnerabilities such as privilege escalation, denial of service, and buffer overflow. Vulnerability Details CVEID: CVE-2020-4230 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 and 11.5 is...