IBM Spectrum Copy Data Management vulnerabilities

17 CVEs affecting IBM Spectrum Copy Data Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-3669, published 2022-08-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-39065, published 2021-12-13. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum…
CVE-2021-39053, published 2021-12-13. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, caused by the improper handling of requests for Spectrum Copy Data Management Admin…
CVE-2021-39064, published 2021-12-13. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials for the Spectrum Copy Data Management Admin console. IBM…
CVE-2022-31769, published 2022-06-10. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against…
CVE-2021-39052, published 2021-12-13. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization. IBM X-Force ID: 214523.
CVE-2022-22354, published 2022-03-14. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP…
CVE-2021-39051, published 2022-03-14. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to server-side request forgery, caused by improper input of application server registration function. A remote attacker could…
CVE-2021-39058, published 2021-12-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 214617.
CVE-2021-38947, published 2021-12-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 211242.
CVE-2022-30611, published 2022-06-10. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this…

Latest

CVE-2021-3669, published 2022-08-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
CVE-2022-30610, published 2022-06-10. Medium severity, CVSS 4.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An…
CVE-2022-22479, published 2022-06-10. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0through 2.2.15.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a…
CVE-2022-22426, published 2022-06-10. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management Admin 2.2.0.0 through 2.2.15.0 could allow a local attacker to bypass authentication restrictions, caused by the lack of proper session management. An attacker could…
CVE-2022-22344, published 2022-03-14. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct…
CVE-2021-39055, published 2022-03-14. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the…