CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2020-4406
https://notcve.org/view.php?id=CVE-2020-4406
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1 (Linux), 8.1.9.0 through 8.1.9.1 (AIX) web user interfaces could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 179488. IBM Spectrum Protect Client versiones 8.1.7.0 hasta 8.1.9.1 (Linux y Windows), versiones 8.1.9.0 hasta 8.1.9.1 (AIX) e IBM Spectrum Protect para Space Management versiones 8.1.7.0 hasta 8.1.9.1 (Linux), versiones 8.1.9.0 hasta 8.1.9.1 (AIX), las interfaces de usuario web podrían permitir a un atacante remoto secuestrar la acción de clic de la víctima. Al persuadir a una víctima para que visite un sitio Web malicioso, un atacante remoto podría explotar esta vulnerabilidad para secuestrar las acciones de clic de la víctima y posiblemente iniciar nuevos ataques contra la víctima. • https://exchange.xforce.ibmcloud.com/vulnerabilities/179488 https://www.ibm.com/support/pages/node/6221448 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1447
https://notcve.org/view.php?id=CVE-2018-1447
The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972. • http://www.ibm.com/support/docview.wss?uid=swg22014669 http://www.ibm.com/support/docview.wss?uid=swg22014957 http://www.ibm.com/support/docview.wss?uid=swg22015066 http://www.ibm.com/support/docview.wss?uid=swg22015071 http://www.securityfocus.com/bid/104511 http://www.securitytracker.com/id/1041012 https://exchange.xforce.ibmcloud.com/vulnerabilities/139972 • CWE-916: Use of Password Hash With Insufficient Computational Effort •