CVE-2018-1723

Summary of CVE-2018-1723 (IBM Spectrum Scale/GPFS) Root cause: A GPFS/IBM Spectrum Scale component could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files on that node. The vulnerability is associated with IBM Spectrum Scale versions including 4.1.1.0, 4...

CVE-2018-1723

IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2 could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files available on this node. IBM X-Force ID: 147373...

CVE-2018-1783

CVE-2018-1783 affects IBM GPFS/IBM Spectrum Scale components. The IBM bulletins describe that the GPFS command line utility lets an unprivileged, authenticated user with GPFS node access forcibly terminate GPFS and deny data access. Affected products include IBM Spectrum Scale and Db2/PureApplica...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow a unprivileged, auntheticated user to read aribiratry file on node

Summary IBM Spectrum Scale could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files available on this node. Vulnerability Details CVEID: CVE-2018-1723 DESCRIPTION: IBM Spectrum Scale could allow a GPFS command line utility allows an unprivileged,...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale that could allow a unprivileged, auntheticated user to forcefully unterminate and deny access to data available through GPFS

Summary IBM Spectrum Scale could allow an unprivileged, authenticated user with access to a GPFS node to forcefully terminate GPFS and deny access to data available through GPFS. Vulnerability Details CVEID: CVE-2018-1783 DESCRIPTION: IBM GPFS command line utility allows an unprivileged,...

Xxe

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM...

CVE-2018-1704

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to...

CVE-2018-1702

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM...

CVE-2018-1702

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM...

CVE-2018-1704

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to...

CVE-2018-1702

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are affected by a XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this to disclose sensitive information or exhaust memory resources. Root cause is XXE in XML ...

CVE-2018-1704

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to...

CVE-2018-1704

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are affected by CVE-2018-1704, an open redirect vulnerability that enables a remote attacker to conduct phishing by tricking a user into visiting a crafted site and spoofing the URL to redirect to a malici...

Information Disclosure Vulnerability in Multiple IBM Products (CNVD-2018-24838)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from U.S.-based IBM that provides organizations with a single point of control and management, and support for backup and recovery of virtual, physical and cloud environments of all sizes. A...

Denial of Service Vulnerability in Multiple IBM Products (CNVD-2018-20099)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from U.S.-based IBM that provides organizations with a single point of control and management, and support for backup and recovery of virtual, physical and cloud environments of all sizes. A deni...

Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client NetApp Services (CVE-2017-3737, CVE-2017-3738, CVE-2018-0733, CVE-2018-0739)

Summary OpenSSL vulnerabilities were disclosed on December 7, 2017 and March 27, 2018 by the OpenSSL Project. OpenSSL, used by the IBM Spectrum Protect formerly Tivoli Storage Manager Client for network connections with NetApp services, has addressed the applicable CVEs. Vulnerability Details...

CVE-2018-1785

IBM Tivoli Storage Manager IBM Spectrum Protect 7.1 and 8.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 148870...

Code injection

IBM Spectrum Protect 7.1 and 8.1 could allow a local user to corrupt or delete highly sensitive information that would cause a denial of service to other users. IBM X-Force ID: 142696...

Default credentials

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in plain text within an instrumentation log file. IBM X-Force ID: 148622...

CVE-2018-1768

IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in plain text within an instrumentation log file. IBM X-Force ID: 148622...