CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4565
https://notcve.org/view.php?id=CVE-2020-4565
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and server. IBM X-Force ID: 183935. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante obtener información confidencial debido a comunicaciones no seguras que son usadas entre la aplicación y el servidor. IBM X-Force ID: 183935 • https://exchange.xforce.ibmcloud.com/vulnerabilities/183935 https://www.ibm.com/support/pages/node/6238920 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4477
https://notcve.org/view.php?id=CVE-2020-4477
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attacks against the system. IBM X-Force ID: 181779. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, divulga información altamente confidencial en texto plano en el archivo de registro virgo que podría ser usado en futuros ataques contra el sistema. IBM X-Force ID: 181779 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181779 https://www.ibm.com/support/pages/node/6221388 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4471
https://notcve.org/view.php?id=CVE-2020-4471
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP command to the remote server. IBM X-Force ID: 181726. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante no autenticado causar una denegación de servicio o secuestrar sesiones DNS mediante el envío de un comando HTTP especialmente diseñado hacia el servidor remoto. IBM X-Force ID: 181726 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181726 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4470
https://notcve.org/view.php?id=CVE-2020-4470
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server. IBM X-Force ID: 181725. La Consola Administrativa de IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante autenticado cargar archivos arbitrarios que podrían estar ejecutando código arbitrario en el servidor vulnerable. IBM X-Force ID: 181724 • https://exchange.xforce.ibmcloud.com/vulnerabilities/181725 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 38%CPEs: 1EXPL: 0CVE-2020-4469
https://notcve.org/view.php?id=CVE-2020-4469
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. This vulnerability is due to an incomplete fix for CVE-2020-4211. IBM X-Force ID: 181724. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante remoto ejecutar código arbitrario en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181724 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •