CVSS: 10.0EPSS: 38%CPEs: 1EXPL: 0CVE-2020-4469
https://notcve.org/view.php?id=CVE-2020-4469
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. This vulnerability is due to an incomplete fix for CVE-2020-4211. IBM X-Force ID: 181724. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante remoto ejecutar código arbitrario en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/181724 https://www.ibm.com/support/pages/node/6221358 https://www.tenable.com/security/research/tra-2020-37 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2020-4216 – IBM Spectrum Protect Plus Hardcoded Username And Password Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-4216
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 175066. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, contiene credenciales embebidas, tales como una contraseña o clave criptográfica, que es usada para su propia autenticación entrante, comunicación saliente hacia componentes externos o cifrado de datos internos. IBM X-Force ID: 175066 This vulnerability allows remote attackers to bypass authentication on vulnerable installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175066 https://www.ibm.com/support/pages/node/6221332 https://www.zerodayinitiative.com/advisories/ZDI-20-710 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.0EPSS: 10%CPEs: 2EXPL: 0CVE-2020-4241 – IBM Spectrum Protect Plus uploadHttpsCertificate Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-4241
IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 175418. IBM Spectrum Scale e IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podrían permitir a un atacante autenticado remoto ejecutar comandos arbitrarios sobre el sistema. Mediante el envío de una petición especialmente diseñada, un atacante podría explotar esta vulnerabilidad para ejecutar comandos arbitrarios sobre el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175418 https://www.ibm.com/support/pages/node/6114130 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4240 – IBM Spectrum Protect Plus plugin Directory Traversal File Creation Vulnerability
https://notcve.org/view.php?id=CVE-2020-4240
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to overwrite or create arbitrary files on the system. IBM X-Force ID: 175417. IBM Spectrum Protect Plus versiones 10.1.0 hasta 10.1.5, podría permitir a un atacante remoto saltar directorios sobre el sistema. Un atacante podría enviar una petición URL especialmente diseñada para sobrescribir o crear archivos arbitrarios sobre el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175417 https://www.ibm.com/support/pages/node/6116488 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-4209 – IBM Spectrum Protect Plus uploadHttpsCertificate Directory Traversal File Creation Vulnerability
https://notcve.org/view.php?id=CVE-2020-4209
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to create arbitrary files on the system. IBM X-Force ID: 175019. IBM Spectrum Protect Plus versiones10.1.0 hasta la versión 10.1.5, podría permitir a un atacante remoto saltar directorios del sistema. Un atacante podría enviar una petición URL especialmente diseñada que contenga secuencias "dot dot" (/../) para crear archivos arbitrarios en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175019 https://www.ibm.com/support/pages/node/6116488 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •