CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4477
https://notcve.org/view.php?id=CVE-2020-4477
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, divulga información altamente confidencial en texto plano en el archivo de registro virgo que podría ser usado en futuros ataques contra el sistema. IBM X-Force ID: 181779 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181779 https://www.ibm.com/support/pages/node/6221388 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4471
https://notcve.org/view.php?id=CVE-2020-4471
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP command to the remote server. IBM X-Force ID: 181726. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante no autenticado causar una denegación de servicio o secuestrar sesiones DNS mediante el envío de un comando HTTP especialmente diseñado hacia el servidor remoto. IBM X-Force ID: 181726 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181726 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4470
https://notcve.org/view.php?id=CVE-2020-4470
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725. La Consola Administrativa de IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante autenticado cargar archivos arbitrarios que podrían estar ejecutando código arbitrario en el servidor vulnerable. IBM X-Force ID: 181724 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181725 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 38%CPEs: 1EXPL: 0CVE-2020-4469
https://notcve.org/view.php?id=CVE-2020-4469
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. This vulnerability is due to an incomplete fix for CVE-2020-4211. IBM X-Force ID: 181724. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante remoto ejecutar código arbitrario en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181724 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2020-4406
https://notcve.org/view.php?id=CVE-2020-4406
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 179488. IBM Spectrum Protect Client versiones 8.1.7.0 hasta 8.1.9.1 (Linux y Windows), versiones 8.1.9.0 hasta 8.1.9.1 (AIX) e IBM Spectrum Protect para Space Management versiones 8.1.7.0 hasta 8.1.9.1 (Linux), versiones 8.1.9.0 hasta 8.1.9.1 (AIX), las interfaces de usuario web podrían permitir a un atacante remoto secuestrar la acción de clic de la víctima. Al persuadir a una víctima para que visite un sitio Web malicioso, un atacante remoto podría explotar esta vulnerabilidad para secuestrar las acciones de clic de la víctima y posiblemente iniciar nuevos ataques contra la víctima. • https://exchange.xforce.ibmcloud.com/vulnerabilities/179488 https://www.ibm.com/support/pages/node/6221448 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •