CVE-2022-22496

CVE-2022-22496 affects IBM Spectrum Protect Server 8.1.0.000–8.1.14 when a user account is being established and the installation is configured with SESSIONSECURITY=TRANSITIONAL. In this mode, it is susceptible to an offline dictionary attack that could expose credentials. The issue is documented...

CVE-2022-22487

IBM Spectrum Protect Server and its storage agent are affected by CVE-2022-22487, a brute-force login flaw that allows unlimited login attempts to the storage agent without locking the admin ID. This enables a remote attacker to potentially gain unauthorized administrative access to both the stor...

CVE-2018-1788

IBM Spectrum Protect Server (former Tivoli Storage Manager) versions affected: 7.1.0.0–7.1.9.0 and 8.1.0.0–8.1.5.x. The issue is an information disclosure where passwords or highly sensitive data can be written to trace logs and exposed to a local privileged user when tracing is enabled. Root cau...

CVE-2025-3319

IBM Spectrum Protect Server versions 8.1–8.1.26 are affected by an authentication bypass due to improper session authentication, potentially enabling access to unauthorized resources. The IBM security bulletin (CVE-2025-3319) confirms the issue and lists AIX/Linux/Windows platforms; remediation i...

CVE-2020-4591

IBM Spectrum Protect Server 8.1.0.000–8.1.10.000 is affected by an information disclosure vulnerability arising from occasionally not encrypting the second chunk of an object in an encrypted container pool in non-default settings. This is documented across multiple sources (NVD, IBM security bull...