IBM Spectrum Protect Plus
49 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2020-4497 | 10.1.0 – < 10.1.12 | IBM Spectrum Protect Plus information disclosure | MEDIUM 6.8 | 0.4 % | ||
| CVE-2022-40608 | 10.1.6 ; 10.1.11 | IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by man | HIGH 7.5 | 1.8 % | ||
| CVE-2022-40234 | 10.1.0 ; 10.1.11 | Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the | MEDIUM 5.9 | 0.6 % | ||
| CVE-2022-22472 | 10.1.5 ; 10.1.7 ; 10.1.10.2 | IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat Ope | HIGH 8.8 | 0.9 % | ||
| CVE-2022-22396 | 10.1.0.0 ; 10.1.9.3 | Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credential | HIGH 7.5 | 0.7 % | ||
| CVE-2022-22354 | 10.1.0.0 ; 10.1.9.2 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length o | HIGH 7.5 | 0.9 % | ||
| CVE-2021-39063 | 10.1.0.0 ; 10.1.8.0 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out pri | CRITICAL 9.1 | 0.7 % | ||
| CVE-2021-39057 | 10.1.0.0 ; 10.1.8.0 | IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated att | HIGH 8.1 | 0.5 % | ||
| CVE-2020-4496 | 10.1.0.0 ; 10.1.8.0 | The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man | MEDIUM 6.8 | 0.6 % | ||
| CVE-2021-20490 | 10.1.0 ; 10.1.8 | IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settin | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-29694 | 10.1.0 ; 10.1.7 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h | HIGH 7.5 | 0.7 % | ||
| CVE-2021-20536 | 10.1.6 ; 10.1.7 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a | MEDIUM 6.2 | 0.3 % | ||
| CVE-2021-20432 | 10.1.0 ; 10.1.7 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privile | MEDIUM 6.5 | 0.7 % | ||
| CVE-2020-5023 | 10.1.0 ; 10.1.7 | IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash d | HIGH 7.5 | 2.3 % | ||
| CVE-2020-5022 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attac | MEDIUM 5.3 | 1.0 % | ||
| CVE-2020-5021 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to imperso | MEDIUM 4.4 | 0.2 % | ||
| CVE-2020-5020 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a v | MEDIUM 6.1 | 0.9 % | ||
| CVE-2020-5019 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST h | MEDIUM 6.5 | 1.3 % | ||
| CVE-2020-5018 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being | HIGH 7.5 | 0.7 % | ||
| CVE-2020-5017 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permis | MEDIUM 5.5 | 0.3 % | ||
| CVE-2020-4854 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for | CRITICAL 9.8 | 2.4 % | ||
| CVE-2020-4783 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to prop | MEDIUM 5.9 | 1.2 % | ||
| CVE-2020-4711 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send | MEDIUM 6.5 | 2.6 % | ||
| CVE-2020-4703 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which | HIGH 8.0 | 1.8 % | ||
| CVE-2020-4631 | 10.1.0 ; 10.1.6 | IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with | MEDIUM 5.5 | 0.2 % | ||
| CVE-2020-4565 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being | MEDIUM 5.9 | 1.2 % | ||
| CVE-2020-4477 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be us | MEDIUM 6.5 | 0.9 % | ||
| CVE-2020-4471 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions | MEDIUM 6.5 | 2.7 % | ||
| CVE-2020-4470 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which | HIGH 8.0 | 1.9 % | ||
| CVE-2020-4469 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially | CRITICAL 9.8 | 13 % | ||
| CVE-2020-4216 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for | CRITICAL 9.8 | 1.6 % | ||
| CVE-2020-4209 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send | MEDIUM 5.4 | 1.4 % | ||
| CVE-2020-4242 | 10.1.0 ; 10.1.5 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm | HIGH 8.8 | 4.6 % | ||
| CVE-2020-4241 | 10.1.0 ; 10.1.5 | IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary comm | HIGH 8.8 | 66 % | ||
| CVE-2020-4240 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send | MEDIUM 6.5 | 2.0 % | ||
| CVE-2020-4214 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to arbitrary delete a directory caused by improper validation | HIGH 7.5 | 1.6 % | ||
| CVE-2020-4208 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for | CRITICAL 9.8 | 1.8 % | ||
| CVE-2020-4206 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of | HIGH 8.8 | 4.6 % | ||
| CVE-2020-4222 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf | CRITICAL 9.8 | 15 % | ||
| CVE-2020-4213 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf | CRITICAL 9.8 | 15 % | ||
| CVE-2020-4212 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf | CRITICAL 9.8 | 15 % | ||
| CVE-2020-4211 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf | CRITICAL 9.8 | 71 % | ||
| CVE-2020-4210 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially craf | CRITICAL 9.8 | 15 % | ||
| CVE-2019-4703 | 10.1.0 ; 10.1.5 | IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate know | MEDIUM 5.3 | 0.5 % | ||
| CVE-2019-4652 | 10.1.0 ; 10.1.4 | IBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allo | HIGH 7.1 | 0.3 % | ||
| CVE-2019-4383 | 10.1.0 ; 10.1.2 ; 10.1.3 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may r | HIGH 7.9 | 0.4 % | ||
| CVE-2019-4357 | 10.1.0 ; 10.1.2 ; 10.1.3 | When using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation | HIGH 8.2 | 0.5 % | ||
| CVE-2019-4385 | 10.1.2 | IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker | MEDIUM 6.5 | 0.3 % | ||
| CVE-2018-1768 | 10.1.0 ; 10.1.1 | IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user | HIGH 7.8 | 0.4 % |