SP
Product
Spectrum Protect Plus
44
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 16Medium 23Low 0
Watch
Add Spectrum Protect Plus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-4383 | 6.7 | Jul 1 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user… Affected: 10.1.1; 10.1.2; 10.1.3 |
| CVE-2019-4357 | 6.7 | Jul 1 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow… Affected: 10.1.1; 10.1.2; 10.1.3 |
| CVE-2021-20432 | 6.5 | Apr 26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive… Affected: 10.1.0 through 10.1.7 |
| CVE-2020-5019 | 6.5 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers Affected: 10.1.0 before 10.1.7 |
| CVE-2020-4711 | 6.5 | Sep 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4477 | 6.5 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4471 | 6.5 | Jun 15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-4240 | 6.5 | Mar 31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2019-4385 | 6.5 | Jun 19 | IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog Affected: 10.1.2.219 through 10.1.2.303 |
| CVE-2021-20536 | 6.2 | Apr 26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user Affected: 10.1.6; 10.1.7 |
| CVE-2020-5020 | 6.1 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim Affected: 10.1.0 before 10.1.7 |
| CVE-2020-4497 | 5.9 | Dec 14 | IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap… Affected: 10.1.0 before 10.1.13 |
| CVE-2022-40234 | 5.9 | Sep 19 | Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a… Affected: before 10.1.12 |
| CVE-2020-4496 | 5.9 | Dec 13 | The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper… Affected: 10.1.0 through 10.1.8.1 |
| CVE-2020-4783 | 5.9 | Nov 23 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4565 | 5.9 | Jun 26 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and… Affected: 10.1.0 through 10.1.5 |
| CVE-2021-3669 | 5.5 | Aug 26 | A flaw was found in the Linux kernel Affected: 10.1.0 through 10.1.10.2 |
| CVE-2021-20490 | 5.5 | Jun 29 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings Affected: 10.1.0 through 10.1.8 |
| CVE-2020-4631 | 5.5 | Aug 4 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could… Affected: 10.1.0 through 10.1.6 |
| CVE-2020-4209 | 5.4 | May 4 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system Affected: 10.1.0 through 10.1.5 |
| CVE-2020-5022 | 5.3 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacker obtaining information they are not… Affected: 10.1.0 before 10.1.7 |
| CVE-2019-4703 | 5.3 | Feb 24 | IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly… Affected: 10.1.0 through 10.1.5 |
| CVE-2020-5021 | 4.4 | Jan 8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersonate another user on the system Affected: 10.1.0 before 10.1.7 |
Showing 23