CVE-2019-4259

CVE-2019-4259 affects IBM Spectrum Scale with CES stack enabled (versions 4.1.1–5.0.0). Affected component: CES stack, where sensitive data could be included with service snaps. The IBM bulletin identifies affected releases and provides fixes: upgrade to V4.1.1.23 (for 4.1.1 branch), V4.2.3.14 (f...

CVE-2020-4273

CVE-2020-4273 affects IBM Spectrum Scale (GPFS) 4.2 and 5.0. A local unprivileged attacker with environmental knowledge could execute commands as root via specially crafted input. Reports in IBM bulletins confirm the vulnerability and provide remediation paths: update to IBM Spectrum Scale 5.x wi...

CVE-2022-43869

Summary: CVE-2022-43869 affects IBM Spectrum Scale (versions 5.1.0.0–5.1.2.8 and 5.1.3.0–5.1.5.1) and IBM Elastic Storage System (ESS) (6.1.0.0–6.1.2.4 and 6.1.3.0–6.1.4.1). An authenticated user can cause a denial of service through the GUI by exploiting a format-string vulnerability in the GUI ...

CVE-2022-22368

CVE-2022-22368 affects IBM Spectrum Scale (versions 5.1.0–5.1.3.0). The root cause is weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM security notices (IBM Spectrum Scale/ESS bulletins) list affected products and versions and...

CVE-2022-40607

CVE-2022-40607 affects IBM Spectrum Scale CSI (2.6.0 and CNSA 5.1.4.0 or earlier). Affected component: CSI allowing users with permissions to create pods, persistent volumes, and PVCs to access files/directories outside the intended volume, including host filesystem. Root cause described as direc...

CVE-2020-4927

IBM Spectrum Scale (core component) versions 5.0.5.0–5.1.6.1 contain a vulnerability that could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. Impact is limited to affected file-system-hosting clusters. Remediation per IBM bulletin: upgrade to...

CVE-2020-4926

The CVE-2020-4926 issue affects IBM Spectrum Scale 5.1 core components and IBM Elastic Storage System 6.1, enabling an unauthorized user to access sensitive data or inject arbitrary data into the communication protocol. IBM and CVE entries indicate the vulnerability could be exploited via the CLI...

CVE-2021-38882

IBM Spectrum Scale versions 5.1.0–5.1.1.1 expose a vulnerability in the filesystem audit logging feature that could allow a privileged administrator to destroy audit logging records before their expiration. The issue requires local access with high privileges; no exploitation details are provided...

CVE-2018-1431

CVE-2018-1431 is a GSKit vulnerability affecting IBM Spectrum Scale components (notably GPFS-based deployments) that could allow a local attacker to gain control of the Spectrum Scale daemon and read/modify files, potentially elevating privileges. Connected IBM bulletins enumerate affected releas...

CVE-2016-0263

IBM Spectrum Scale/GPFS (CVE-2016-0263) can allow a local user to escalate privileges or cause a denial of service when the mmapplypolicy command is used with certain options. Affected products include IBM Spectrum Scale V4.2, V4.1 and General Parallel File System V3.5 (and related ESS/GPFS deplo...

CVE-2016-6115

CVE-2016-6115 affects IBM GPFS/Spectrum Scale (e.g., Elastic Storage Server and GPFS Storage Server). The vulnerability is a buffer overflow in IBM General Parallel File System that could be triggered by a remote authenticated attacker, allowing arbitrary code execution with root privileges or ca...

CVE-2023-30434

CVE-2023-30434 affects IBM Spectrum Scale (IBM Storage Scale) and IBM Elastic Storage Systems. A local user could cause a kernel panic in affected releases: IBM Spectrum Scale 5.1.0.0–5.1.2.9 and 5.1.3.0–5.1.6.1; IBM Elastic Storage System 6.1.0.0–6.1.2.5 and 6.1.3.0–6.1.6.0. Root cause is a vuln...

CVE-2020-4241

CVE-2020-4241 affects IBM Spectrum Protect Plus 10.1.0–10.1.5. A command injection exists due to lack of input validation in the Administrative Console’s uploadHttpsCertificate filename parameter, enabling a remote authenticated attacker to execute arbitrary commands on the target system. Connect...

CVE-2021-29667

According to IBM and NVD sources, CVE-2021-29667 affects IBM Spectrum Scale 5.0.0–5.0.5.6 and 5.1.0–5.1.0.2, with a CSV Injection vulnerability caused by improper validation of CSV contents that could let an attacker remotely execute arbitrary commands on a vulnerable system. The combined documen...

CVE-2017-1654

This CVE (CVE-2017-1654) affects IBM Spectrum Scale: affected versions include 4.1.1, 4.2.0–4.2.3 and 5.0.0, where a local unprivileged user could access information stored in dump/trace files. The IBM bulletins describe that dump contents, including user data, could be written to recovery logs o...

CVE-2020-4492

CVE-2020-4492 – IBM Spectrum Scale : A local attacker could cause a denial of service by sending a subset of ioctls with invalid arguments, crashing the kernel. Affected: IBM Spectrum Scale V5.0.0.0–V5.0.4.3 and V4.2.0.0–V4.2.3.21. Impact: high availability disruption (local exploit). Remediation...

CVE-2021-29708

CVE-2021-29708 affects IBM Spectrum Scale CNSA 5.1.0.1. A local attacker with access to the GUI pod container could obtain sensitive cryptographic keys, enabling privilege elevation to a privileged core-pod user. The IBM bulletin confirms the vulnerability and provides a fix: upgrade to Spectrum ...

CVE-2015-4974

CVE-2015-4974 affects IBM GPFS/Spectrum Scale: local attacker could execute commands with root privileges. A related issue, CVE-2015-4981, could allow reading system memory contents. Affected products include GPFS 3.5.x before 3.5.0.27, GPFS 4.1.x before 4.1.1.2, and Spectrum Scale 4.1.1.x before...

CVE-2020-4925

IBM Spectrum Scale 5.0 and 5.1 are affected by CVE-2020-4925, where a non-root user can overflow the mmfsd daemon with requests and prevent the daemon from servicing other requests. The issue is mitigated by upgrading to 5.1.1 or later (including 5.1.2+); remediation guidance is provided in IBM’s...

CVE-2015-4981

CVE-2015-4981 is described in IBM security advisories as a local memory-read vulnerability in IBM GPFS/Spectrum Scale. The issue allows a local, non-privileged attacker to read system memory contents via GPFS components across affected releases. Affected products/versions include IBM GPFS (now IB...

CVE-2015-7403

CVE-2015-7403 affects IBM Spectrum Scale (GPFS) on AIX, with vulnerable components including Spectrum Scale 4.1.x (before 4.1.1.3) and GPFS 3.5.x and 4.1.x (before 4.1.0.8/3.5.0.29). Root cause described as a local denial-of-service due to a user pointer dereference that can crash the node. Affec...

CVE-2022-43843

IBM Spectrum Scale Data Access Services (DAS) is affected by CVE-2022-43843 due to the use of weaker-than-expected cryptographic algorithms in TLS, potentially allowing decryption of highly sensitive information. Affected product: IBM Spectrum Scale, versions 5.1.5.0 through 5.1.5.1. Root cause: ...

CVE-2020-4242

CVE-2020-4242 affects IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0–10.1.5. The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM’s Security Bulletin (and related IBM X-Force data) confirms a command-inje...

CVE-2020-4411

CVE-2020-4411 affects IBM Spectrum Scale kernel module in Spectrum Scale 4.2.0.0–4.2.3.21 and 5.0.0.0–5.0.4.3. A local attacker can trigger a denial-of-service by invoking a subset of ioctls with invalid arguments, potentially crashing the kernel. Affected IBM products include IBM Spectrum Scale ...

CVE-2020-4755

Summary: CVE-2020-4755 affects IBM Spectrum Scale 5.0.0–5.0.5.2 and is a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The IBM IBM Spectrum Scale GUI is implicated across multiple advisories (CVE-2020-4755 with X-Force ID 188595...

CVE-2020-4217

Affected product/component: IBM Spectrum Scale file system component (mmfsd/mmsdrserv daemons) in Spectrum Scale 4.2 and 5.0. Root cause/impact: Denial of service could cause the mmfsd/mmsdrserv daemons to terminate unexpectedly, impacting cluster functionality and file-system availability. Explo...

CVE-2016-2984

CVE-2016-2984 affects IBM Spectrum Scale/GPFS: local users can gain root privileges via crafted command-line parameters to a setuid binary in /usr/lpp/mmfs/bin. Affected versions include GPFS 3.5.x before 3.5.0.32, GPFS 4.1.x before 4.1.1.8, Spectrum Scale 4.1.1.x before 4.1.1.8, and 4.2.x before...

CVE-2020-4350

CVE-2020-4350 affects IBM Spectrum Scale (and related IBM ESS/GUIs) versions 5.0.0.0 through 5.0.4.4, where weaker cryptographic algorithms could allow decryption of highly sensitive data. Connected IBM advisories specify the affected products and versions, with remediations: IBM Spectrum Scale G...

CVE-2021-29740

CVE-2021-29740 affects IBM Spectrum Scale (5.0.0–5.0.5.6 and 5.1.0–5.1.0.3) and IBM Elastic Storage System variants, due to a format-string vulnerability in the system core component that could allow arbitrary code execution with root privileges. Remediation is to upgrade to recommended fixed lev...

CVE-2018-1782

CVE-2018-1782 affects IBM Spectrum Scale (GPFS) 5.0.1.0 and 5.0.1.1. A local, unprivileged user can trigger a kernel panic on a node running GPFS by either mmap-ing a file stored on a GPFS file system or by executing a crafted file stored on GPFS. IBM’s notices confirm the vulnerability is limite...

CVE-2020-4748

CVE-2020-4748 concerns IBM Spectrum Scale 5.0.0–5.0.5.2, where the Web UI is vulnerable to cross-site scripting, allowing arbitrary JavaScript in a trusted session and potential credential disclosure. The IBM bulletin confirms the affected range and notes a remediation: upgrade to code levels 5.0...

CVE-2015-7488

IBM Spectrum Scale (GPFS) is affected by CVE-2015-7488 in versions 4.1.1.x before 4.1.1.4 and 4.2.x before 4.2.0.1. Descriptions across IBM security bulletins indicate that a local unprivileged user or a user with network access could obtain the LDAP bind directory password when the File protocol...

CVE-2018-1783

CVE-2018-1783 affects IBM GPFS/IBM Spectrum Scale components. The IBM bulletins describe that the GPFS command line utility lets an unprivileged, authenticated user with GPFS node access forcibly terminate GPFS and deny data access. Affected products include IBM Spectrum Scale and Db2/PureApplica...

CVE-2019-4558

CVE-2019-4558 affects IBM Spectrum Scale (GPFS) across multiple lines: V5.0.0.0–V5.0.3.2 and V4.2.0.0–V4.2.3.17 permit a local attacker to obtain root privileges by injecting parameters into setuid files. IBM and vendor bulletins (Storwize V7000 Unified, Db2 LUW on AIX/Linux, Elastic Storage Serv...

CVE-2020-4891

CVE-2020-4891 affects IBM Spectrum Scale: versions 5.0.0–5.0.5.5 and 5.1.0–5.1.0.2 expose an improper account lockout setting that could let a local attacker brute‑force REST API credentials. Affected product: IBM Spectrum Scale (GPFS-based). Root cause: inadequate local account lockout configura...

CVE-2019-4665

IBM Spectrum Scale is affected by a cross-site scripting vulnerability in the Web UI (CVE-2019-4665). The IBM Security Bulletin summary states that versions 4.2.0.0–4.2.3.18 and 5.0.0.0–5.0.4.0 are vulnerable to injecting arbitrary JavaScript in the Web UI, potentially leading to credential discl...

CVE-2020-4349

CVE-2020-4349 : IBM Spectrum Scale (GPFS) 5.0.0.0–5.0.4.4 uses weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM references the vulnerability in multiple advisories for ESS/Spectrum Scale GUI and ESS 3000, with affected products including IB...

CVE-2020-4357

Summary of CVE-2020-4357 details (from connected IBM/Spectrum Scale sources): IBM Spectrum Scale and the IBM Spectrum Scale GUI are affected by verbose/error disclosure where detailed technical error messages returned in the browser can reveal sensitive information. Affected products/versions inc...

CVE-2020-4379

CVE-2020-4379 affects IBM Spectrum Scale 5.0.0.0 through 5.0.4.4, where weaker cryptographic algorithms could allow decryption of highly sensitive information. IBM’s bulletins show affected products and versions (Spectrum Scale GUI and ESS GUI) and outline remediation paths: upgrade to Spectrum S...

CVE-2020-4348

CVE-2020-4348 affects IBM Spectrum Scale GUI components: versions 4.2.0.0–4.2.3.21 and 5.0.0.0–5.0.4.4 allow an authenticated GUI user to perform unauthorized actions due to missing function-level access control. Documents from IBM Security Bulletins identify affected products and fixes: Spectrum...

CVE-2020-4378

CVE-2020-4378 affects IBM Spectrum Scale GUI (and ESS) with versions 5.0.0.0–5.0.4.4 (and ESS 3000 GUI variants). The issue allows a privileged, authenticated user to perform unauthorized actions via a specially crafted HTTP POST command. Root cause details are not explicitly broken out in the pr...

CVE-2015-7456

The CVE-2015-7456 issue affects IBM Spectrum Scale (including GPFS) with vulnerable versions 4.1.1.x before 4.1.1.4 and 4.2.0.0, enabling a remote authenticated (or local) user to discover object-storage admin passwords via unspecified vectors. IBM’s security bulletin summaries state exploitation...

CVE-2016-2985

CVE-2016-2985 affects IBM Spectrum Scale/GPFS where a local attacker can gain root privileges by manipulating environment variables processed by setuid executables under /usr/lpp/mmfs/bin. Affected products/versions include IBM Spectrum Scale V4.2.0.x before 4.2.0.4, V4.1.1.x before 4.1.1.8, and ...

CVE-2018-1723

Summary of CVE-2018-1723 (IBM Spectrum Scale/GPFS) Root cause: A GPFS/IBM Spectrum Scale component could allow an unprivileged, authenticated user with access to a GPFS node to read arbitrary files on that node. The vulnerability is associated with IBM Spectrum Scale versions including 4.1.1.0, 4...

CVE-2020-4412

CVE-2020-4412 affects IBM Spectrum Scale file system components (versions 4.2.0.0–4.2.3.21 and 5.0.0.0–5.0.4.3). The vulnerability allows a local attacker to force the mmfsd/mmsdrserv daemons to exit, impacting cluster functionality and file-system availability (DoS). Some IBM bulletin entries al...

CVE-2020-4749

CVE-2020-4749 affects IBM Spectrum Scale 5.0.0 through 5.0.5.2, where authorization tokens or session cookies are issued without the secure attribute, enabling cookie snooping if a user visits an http link. Impact is limited to disclosure of cookie values via insecure requests; exploitation requi...

CVE-2020-4851

CVE-2020-4851 affects IBM Spectrum Scale 5.0.0–5.0.5.5 and 5.1.0–5.1.0.2. A local attacker can tamper with log files due to an access control error, potentially impacting support and development. Remediation: upgrade to IBM Spectrum Scale 5.0.5.5 (HDFS Transparency 3.1.0-7) or later for the 5.0 b...

CVE-2020-4890

IBM Spectrum Scale vulnerability CVE-2020-4890 affects versions 5.0.0–5.0.5.5 and 5.1.0–5.1.0.2. A local user with a valid REST API role can cause a denial of service due to weak or absent rate limiting on REST API requests. The root cause is insufficient rate-limiting controls; impact is availab...

CVE-2021-29666

The IBM Spectrum Scale GUI/web UI is affected by CVE-2021-29666 (and related CVEs) with cross-site scripting in versions 5.0.0–5.0.5.6 and 5.1.0–5.1.0.2, potentially allowing arbitrary JavaScript execution and credential disclosure within a trusted session. Affected products include IBM Elastic S...

CVE-2021-29671

CVE-2021-29671 affects IBM Spectrum Scale 5.1.0.1, where a local attacker could bypass the filesystem audit logging mechanism when file audit logging is enabled. IBM’s bulletin confirms the affected product and provides a fix: upgrade to IBM Spectrum Scale 5.1.0.2 or later (FixCentral). No exploi...