CVE-2018-1447

CVE-2018-1447 affects the GSKit CMS KDB logic used with IBM Spectrum Protect 7.1/7.2 and IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6, where the hashing process is not salted, yielding weaker password protection and potential password recovery. The vulnerability is discussed in IBM GSKit...

CVE-2021-29672

The CVE-2021-29672 issue affects IBM Spectrum Protect Client versions 8.1.0.0–8.1.11.0 (and 1.11.0), where a stack-based buffer overflow arises from improper bounds checking while processing locale settings. A local attacker could overflow a buffer to execute arbitrary code with elevated privileg...

CVE-2021-20546

CVE-2021-20546 affects IBM Spectrum Protect Client versions 8.1.0.0 through 8.1.11.0, where a stack-based buffer overflow can be triggered by improper bounds checking when processing locale/current language environment settings. This local vulnerability can cause the client to crash and may allow...

CVE-2023-33832

The CVE-2023-33832 issue affects IBM Storage Protect family: Storage Protect Client, Storage Protect for Virtual Environments, and Storage Protect for Space Management (versions 8.1.0.0–8.1.17.0). Root cause is improper time-of-check to time-of-use, enabling a local user to cause a denial of serv...

CVE-2021-39048

CVE-2021-39048 affects IBM Spectrum Protect Client 7.1 and 8.1, with a stack-based buffer overflow due to improper bounds checking. Local attackers could cause a denial of service. Public sources (e.g., Gentoo GLSA 202209-02) indicate fixes are available: upgrade to IBM Spectrum Protect Client 7....

CVE-2020-4406

CVE-2020-4406 affects IBM Spectrum Protect Client (Linux/Windows) 8.1.7.0–8.1.9.1 and IBM Spectrum Protect for Space Management 8.1.7.0–8.1.9.1, with AIX 8.1.9.0–8.1.9.1 also listed. The vulnerability is a clickjacking exposure in the web user interface that could allow a remote attacker to hijac...

CVE-2020-4494

CVE-2020-4494 affects IBM Spectrum Protect Client (Linux/Windows) versions 8.1.7.0–8.1.9.1 and Spectrum Protect for Space Management (Linux) 8.1.7.0–8.1.9.1, with web UIs that could bypass authentication due to improper session validation, potentially granting access to unauthorized resources. IB...