Spectrum Protect Plus (Ibm) - vulnerabilities (CVEs)

49 CVEs, 0 in the last 30 days, 54 known versions, newest CVE from 2024-02-02. Vendor: Ibm.

CVEs of Spectrum Protect Plus

CVE-2023-47148 - CVSS 7.5 (high), 2024-02-02: IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper…
CVE-2020-4497 - CVSS 6.8 (medium), 2022-12-14: IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum…
CVE-2022-40234 - CVSS 5.9 (medium), 2022-09-19: Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt…
CVE-2022-40608 - CVSS 7.5 (high), 2022-09-19: IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL…
CVE-2021-3669 - CVSS 5.5 (medium), 2022-08-26: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource…
CVE-2022-22472 - CVSS 8.8 (high), 2022-06-30: IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could…
CVE-2022-22396 - CVSS 7.5 (high), 2022-06-06: Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the…
CVE-2022-22354 - CVSS 7.5 (high), 2022-03-14: IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection…
CVE-2021-39063 - CVSS 9.1 (critical), 2021-12-13: IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions…
CVE-2021-39057 - CVSS 8.1 (high), 2021-12-13: IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send…
CVE-2020-4496 - CVSS 6.8 (medium), 2021-12-13: The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle…
CVE-2021-20490 - CVSS 5.5 (medium), 2021-06-29: IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force…
CVE-2021-20536 - CVSS 6.2 (medium), 2021-04-26: IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM…
CVE-2021-29694 - CVSS 7.5 (high), 2021-04-26: IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…
CVE-2021-20432 - CVSS 6.5 (medium), 2021-04-26: IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and…
CVE-2020-5023 - CVSS 7.5 (high), 2021-02-10: IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess…
CVE-2020-5022 - CVSS 5.3 (medium), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining…
CVE-2020-5018 - CVSS 7.5 (high), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an…
CVE-2020-5021 - CVSS 4.4 (medium), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user…
CVE-2020-5017 - CVSS 5.5 (medium), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force…
CVE-2020-5020 - CVSS 6.1 (medium), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a…
CVE-2020-5019 - CVSS 6.5 (medium), 2021-01-08: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending…
CVE-2020-4783 - CVSS 5.9 (medium), 2020-11-23: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP…
CVE-2020-4854 - CVSS 9.8 (critical), 2020-11-23: IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2020-4711 - CVSS 6.5 (medium), 2020-09-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2020-4703 - CVSS 8 (high), 2020-09-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute…
CVE-2020-4631 - CVSS 5.5 (medium), 2020-08-04: IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control…
CVE-2020-4565 - CVSS 5.9 (medium), 2020-06-26: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the…
CVE-2020-4471 - CVSS 6.5 (medium), 2020-06-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a…
CVE-2020-4470 - CVSS 8 (high), 2020-06-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute…
CVE-2020-4477 - CVSS 6.5 (medium), 2020-06-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further…
CVE-2020-4216 - CVSS 9.8 (critical), 2020-06-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2020-4469 - CVSS 9.8 (critical), 2020-06-15: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP…
CVE-2020-4209 - CVSS 5.4 (medium), 2020-05-04: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2020-4242 - CVSS 8.8 (high), 2020-03-31: IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the…
CVE-2020-4241 - CVSS 8.8 (high), 2020-03-31: IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the…
CVE-2020-4240 - CVSS 6.5 (medium), 2020-03-31: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a…
CVE-2020-4214 - CVSS 7.5 (high), 2020-03-31: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied…
CVE-2020-4208 - CVSS 9.8 (critical), 2020-03-31: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2020-4206 - CVSS 8.8 (high), 2020-03-31: IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused…
CVE-2019-4703 - CVSS 5.3 (medium), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the…
CVE-2020-4212 - CVSS 9.8 (critical), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command,…
CVE-2020-4211 - CVSS 9.8 (critical), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command,…
CVE-2020-4222 - CVSS 9.8 (critical), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command,…
CVE-2020-4210 - CVSS 9.8 (critical), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command,…
CVE-2020-4213 - CVSS 9.8 (critical), 2020-02-24: IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command,…
CVE-2019-4652 - CVSS 7.1 (high), 2019-11-12: IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to…
CVE-2019-4357 - CVSS 8.2 (high), 2019-07-01: When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a…
CVE-2019-4383 - CVSS 7.9 (high), 2019-07-01: When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an…
CVE-2019-4385 - CVSS 6.5 (medium), 2019-06-19: IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to…
CVE-2018-1768 - CVSS 7.8 (high), 2018-09-26: IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password…