CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-22494
https://notcve.org/view.php?id=CVE-2022-22494
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-crafted HTTP request. This information could then be used in future attacks. IBM X-Force ID: 226940. IBM Spectrum Protect Operations Center 8.1.0.000 hasta 8.1.14, podría permitir a un atacante remoto conseguir detalles de la base de datos, como el tipo y la versión, mediante el envío de una petición HTTP especialmente diseñada. Esta información podría usarse en futuros ataques. • https://exchange.xforce.ibmcloud.com/vulnerabilities/226940 https://www.ibm.com/support/pages/node/6596883 •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-22485
https://notcve.org/view.php?id=CVE-2022-22485
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325. En algunos casos, un intento fallido de iniciar sesión en IBM Spectrum Protect Operations Center versiones 8.1.0.000 hasta 8.1.14.000, no causa que el recuento de inicios de sesión no válidos del administrador sea incrementado en el servidor de IBM Spectrum Protect. Un atacante podría aprovechar esta vulnerabilidad usando técnicas de fuerza bruta para conseguir acceso administrativo no autorizado al servidor IBM Spectrum Protect. • https://exchange.xforce.ibmcloud.com/vulnerabilities/226325 https://www.ibm.com/support/pages/node/6595655 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22348
https://notcve.org/view.php?id=CVE-2022-22348
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 220139. IBM Spectrum Protect Operations Center versiones 8.1.0.000 hasta 8.1.13.xxx, es vulnerable un tabnabbing inverso, que podría permitir reescribir una página enlazada desde Operations Center. • https://exchange.xforce.ibmcloud.com/vulnerabilities/220139 https://www.ibm.com/support/pages/node/6562855 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22346
https://notcve.org/view.php?id=CVE-2022-22346
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048. IBM Spectrum Protect Operations Center versiones 8.1.0.000 hasta 8.1.13.xxx, es vulnerable a una vulnerabilidad de tipo cross-site request forgery, lo que podría permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas desde un usuario del que el sitio web confía. IBM X-Force ID: 220048 • https://exchange.xforce.ibmcloud.com/vulnerabilities/220048 https://www.ibm.com/support/pages/node/6562855 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-4956
https://notcve.org/view.php?id=CVE-2020-4956
IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156. IBM Spectrum Protect Operations Center versiones 7.1 y 8.1, es vulnerable a una denegación de servicio, causada por un RPC que permite a determinados valores de caché ser ajustada y ser volcada a un archivo. Al ajustar un valor de caché enormemente grande y volcar ese valor en caché en un archivo múltiples veces, un atacante remoto podría explotar esta vulnerabilidad para causar el consumo de todos los recursos de memoria. • https://exchange.xforce.ibmcloud.com/vulnerabilities/192156 https://www.ibm.com/support/pages/node/6404966 • CWE-400: Uncontrolled Resource Consumption •