CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-47148 – IBM Storage Protect Plus Server information disclosure
https://notcve.org/view.php?id=CVE-2023-47148
02 Feb 2024 — IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599. IBM Storage Protect Plus Server 10.1.0 a 10.1.15.2 Admin Console podría permitir que un atacante remoto obtenga información confidencial debido a una validación inadecuada de endpoints no seguros que podrían usarse en futuros ataques contra el si... • https://exchange.xforce.ibmcloud.com/vulnerabilities/270599 • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4497 – IBM Spectrum Protect Plus information disclosure
https://notcve.org/view.php?id=CVE-2020-4497
14 Dec 2022 — IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106. IBM Spectrum Protect Plus 10.1.0 a 10.1.12 divulga información confidencial debido al uso de datos no cifrados en el flujo de comunicación entre Spectrum Protect Plus vSnap y sus agentes. Un atacante podría obtener infor... • https://exchange.xforce.ibmcloud.com/vulnerabilities/182106 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40608
https://notcve.org/view.php?id=CVE-2022-40608
19 Sep 2022 — IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory traversal attack. This results in the restore operation gaining access to files which the operator should not have access to. IBM X-Force ID: 235873. IBM Spectrum Protect Plus versiones 10.1.6 hasta 10.1.11, la operación de restauración de Microsoft File Systems puede descargar cualquier archivo en el equipo de destino al manipular la ... • https://exchange.xforce.ibmcloud.com/vulnerabilities/235873 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40234
https://notcve.org/view.php?id=CVE-2022-40234
19 Sep 2022 — Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718. Las versiones de IBM Spectrum Protect Plus anteriores a 10.1.12 (excluyendo la 10.1.12) incluyen la información de la clave privada de un certifi... • https://exchange.xforce.ibmcloud.com/vulnerabilities/235718 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22472
https://notcve.org/view.php?id=CVE-2022-22472
30 Jun 2022 — IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session information. By retrieving the logs of a container an attacker could exploit this vulnerability to bypass login security of the IBM Spectrum Protect Plus server and gain unauthorized access based on the permissions of... • https://exchange.xforce.ibmcloud.com/vulnerabilities/225340 • CWE-281: Improper Preservation of Permissions •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-22396
https://notcve.org/view.php?id=CVE-2022-22396
06 Jun 2022 — Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231. Las credenciales son impresas en texto sin cifrar en el archivo de registro de virgo de IBM Spectrum Protect Plus versiones 10.1.0.0 hasta 10.1.9.3 en determinados casos. • https://exchange.xforce.ibmcloud.com/vulnerabilities/222231 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 34EXPL: 0CVE-2021-3669 – kernel: reading /proc/sysvipc/shm does not scale with large shared memory segment counts
https://notcve.org/view.php?id=CVE-2021-3669
11 May 2022 — A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS. Se ha encontrado un fallo en el kernel de Linux. La medición del uso de la memoria compartida no escala con grandes recuentos de segmentos de memoria compartida, lo que podría conllevar a el agotamiento de recursos y el DoS. Red Hat Advanced Cluster Management for Kubernetes 2.5.0 images Red Hat Advanced Cluster Management for Kube... • https://access.redhat.com/security/cve/CVE-2021-3669 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-22354
https://notcve.org/view.php?id=CVE-2022-22354
14 Mar 2022 — IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM X-Force ID: 220485. IBM Spectrum Protect Plus versiones 10.1.0.0 hasta 10.1.9.2 e IBM Spectrum Copy Data Management versiones 2.2.0.0 hasta 2.2.14.3, no limitan la duración de una conexión, lo que podría permitir un a... • https://exchange.xforce.ibmcloud.com/vulnerabilities/220485 •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39063
https://notcve.org/view.php?id=CVE-2021-39063
13 Dec 2021 — IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a misconfiguration in access control headers. IBM X-Force ID: 214956. IBM Spectrum Protect Plus versiones 10.1.0.0 hasta 10.1.8.x, usa Cross-Origin Resource Sharing (CORS), lo que podría permitir a un atacante llevar a cabo acciones privilegiadas y recuperar información confidencial debido a una configuración err... • https://exchange.xforce.ibmcloud.com/vulnerabilities/214956 • CWE-346: Origin Validation Error •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-39057
https://notcve.org/view.php?id=CVE-2021-39057
13 Dec 2021 — IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 214616. IBM Spectrum Protect Plus versiones 10.1.0.0 hasta 10.1.8.x ,es vulnerable a un ataque de tipo server-side request forgery (SSRF). Esto puede permitir a un atacante autenticado enviar peticiones no autorizadas desde el si... • https://exchange.xforce.ibmcloud.com/vulnerabilities/214616 • CWE-918: Server-Side Request Forgery (SSRF) •