SP
Product
Spectrum Protect Plus
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 16Medium 23Low 0
Watch
Add Spectrum Protect Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4854 | 9.8 | Nov 23 | IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4469 | 9.8 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4216 | 9.8 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4208 | 9.8 | Mar 31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 10.1.0 through 10.1.5 |
| CVE-2021-39063 | 9.1 | Dec 13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive… Affected: 10.1.0 before 10.1.9 |
| CVE-2020-4242 | 8.8 | Mar 31 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4241 | 8.8 | Mar 31 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4206 | 8.8 | Mar 31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper… Affected: 10.1.0 through 10.1.5 |
| CVE-2021-39057 | 8.1 | Dec 13 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF) Affected: 10.1.0 before 10.1.9 |
| CVE-2020-4703 | 8.0 | Sep 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4470 | 8.0 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the… Affected: 10.1.0 through 10.1.5 |
| CVE-2018-1768 | 7.8 | Sep 26 | IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may be displayed in… Affected: 10.1.0; 10.1.1 |
| CVE-2023-47148 | 7.5 | Feb 2 | IBM Storage Protect Plus Server information disclosure Affected: 10.1.0 before 10.1.15.3 |
| CVE-2022-40608 | 7.5 | Sep 19 | IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory… Affected: 10.1.6 through 10.1.11 |
| CVE-2022-22396 | 7.5 | Jun 6 | Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases Affected: 10.1.0 before 10.1.10 |
| CVE-2022-22354 | 7.5 | Mar 14 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a… Affected: 10.1.0 before 10.1.9.3 |
| CVE-2021-29694 | 7.5 | Apr 26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 10.1.0 through 10.1.7 |
| CVE-2020-5023 | 7.5 | Feb 10 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resource consumption Affected: 10.1.0 through 10.1.7 |
| CVE-2020-5018 | 7.5 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being caputured by an attacker Affected: 10.1.0 before 10.1.7 |
| CVE-2020-4214 | 7.5 | Mar 31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation of user-supplied input Affected: 10.1.0 through 10.1.5 |
| CVE-2019-4652 | 7.1 | Nov 12 | IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive… Affected: 10.1.0 through 10.1.4 |
| CVE-2019-4383 | 6.7 | Jul 1 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user… Affected: 10.1.1; 10.1.2; 10.1.3 |
| CVE-2019-4357 | 6.7 | Jul 1 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow… Affected: 10.1.1; 10.1.2; 10.1.3 |
| CVE-2021-20432 | 6.5 | Apr 26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive… Affected: 10.1.0 through 10.1.7 |
| CVE-2020-5019 | 6.5 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers Affected: 10.1.0 before 10.1.7 |
| CVE-2020-4711 | 6.5 | Sep 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4477 | 6.5 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4471 | 6.5 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4240 | 6.5 | Mar 31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2019-4385 | 6.5 | Jun 19 | IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog Affected: 10.1.2.219 through 10.1.2.303 |
| CVE-2021-20536 | 6.2 | Apr 26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user Affected: 10.1.6; 10.1.7 |
| CVE-2020-5020 | 6.1 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim Affected: 10.1.0 before 10.1.7 |
| CVE-2020-4497 | 5.9 | Dec 14 | IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap… Affected: 10.1.0 before 10.1.13 |
| CVE-2022-40234 | 5.9 | Sep 19 | Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a… Affected: before 10.1.12 |
| CVE-2020-4496 | 5.9 | Dec 13 | The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper… Affected: 10.1.0 through 10.1.8.1 |
| CVE-2020-4783 | 5.9 | Nov 23 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4565 | 5.9 | Jun 26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and… Affected: 10.1.0 through 10.1.5 |
| CVE-2021-3669 | 5.5 | Aug 26 | A flaw was found in the Linux kernel Affected: 10.1.0 through 10.1.10.2 |
| CVE-2021-20490 | 5.5 | Jun 29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings Affected: 10.1.0 through 10.1.8 |
| CVE-2020-4631 | 5.5 | Aug 4 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4209 | 5.4 | May 4 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2020-5022 | 5.3 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not… Affected: 10.1.0 before 10.1.7 |
| CVE-2019-4703 | 5.3 | Feb 24 | IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-5021 | 4.4 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system Affected: 10.1.0 before 10.1.7 |
Showing 44