PT-2020-17922

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 Description The issue allows a remote attacker to execute arbitrary code on the system by using a specially crafted HTTP command. This enables the attacker to execute arbitrary commands ...

PT-2020-6769

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 Description The issue is related to the failure to neutralize special elements in user-input strings during the syntactic analysis of the hostname parameter. This can be exploited by a...

PT-2020-11035

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.5.0 Description The issue allows an attacker with intimate knowledge of the system to obtain highly sensitive information when protecting Microsoft SQL or Microsoft Exchange. Recommendations...

CVE-2020-4210: Improper Neutralization of Special Elements used in an OS Command

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175020...

CVE-2020-4212: Improper Input Validation

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175023...

IBM Spectrum Protect Plus Information Disclosure Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

CVE-2020-4211: Improper Neutralization of Special Elements used in an OS Command

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175022...

CVE-2020-4213: Improper Neutralization of Special Elements used in an OS Command

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024...

IBM Spectrum Protect Plus Command Injection Vulnerability (CNVD-2020-14212)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

IBM Spectrum Protect Plus Command Injection Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A command injection vulnerability exists in...

PT-2020-17923

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0 through 10.1.5 Description The issue allows a remote attacker to execute arbitrary code on the system by using a specially crafted HTTP command. This can lead to the execution of arbitrary commands on...

Security Bulletin: Command injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4210, CVE-2020-4213, CVE-2020-4222, CVE-2020-4212, CVE-2020-4211)

Summary Command injection vulnerabilities in IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4210 DESCRIPTION: IBM Spectrum Protect Plus could allow a remote attacker to execute arbitrary code on the system. By...

Security Bulletin: Multiple vulnerabilities in Linux Kernel affect IBM Spectrum Protect Plus

Summary There are multiple security vulnerabilities in the Linux Kernel that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-19532 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by multiple out-of-bound write conditions in HID drivers. CVSS Base...

Security Bulletin: Information Disclosure in IBM Spectrum Protect Plus (CVE-2019-4703)

Summary The user id and password may be exposed in IBM Spectrum Protect Plus when protecting Microsoft SQL or Microsoft Exchange. Vulnerability Details CVEID: CVE-2019-4703 DESCRIPTION: IBM Spectrum Protect Plus, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with...

Security Bulletin: Vulnerabilities in Samba affect IBM Spectrum Protect Plus (CVE-2019-14833, CVE-2019-14847, CVE-2019-10218)

Summary Security vulnerabilities in Samba affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-14833 DESCRIPTION: A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new...

Security Bulletin: Vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus (CVE-2019-12402).

Summary A denial of service vulnerability in Apache Commons Compress affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-12402 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an error in the internal file name encoding algorithm. By choosi...

Security Bulletin: Multiple vulnerabilities in FasterXML Jackson-databind affect IBM Spectrum Protect Plus (CVE-2019-16943, CVE-2019-16942, CVE-2019-17531, CVE-2019-17267, CVE-2019-14540, CVE-2019-16335, CVE-2019-14379, CVE-2019-14439)

Summary There are multiple security vulnerabilities in FasterXML Jackson-databind that affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-16943 DESCRIPTION: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0735, CVE-2018-0734, CVE-2018-5407)

Summary OpenSSL vulnerabilities were discllossed by the OpenSSL Project in October and November of 2018. IBM Spectrum Protect Plus uses OpenSSL and has addressed the applicable CVEs. 20 February 2020 - Changed fixing level from 10.1.5 to 10.1.5 patch1. 21 February 2020 - Provided link to 10.1.5...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer

Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer. IBM Spectrum LSF Suite, IBM Spectrum LSF Suite for HPA, and IBM Spectrum LSF Explorer have addressed the applicable CVEs. Vulnerability...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA

Summary There are multiple vulnerabilities in Node.js Version 10 used by IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA. IBM Spectrum LSF Suite and IBM Spectrum LSF Suite for HPA have addressed the applicable CVEs. Vulnerability Details Refer to the security bulletinss listed in the...