IBM Spectrum Protect vulnerabilities

18 CVEs affecting IBM Spectrum Protect, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27863, published 2023-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4211, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 71.1% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4222, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 15.5% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4213, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 15.5% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4210, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 15.5% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4212, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 15% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4415, published 2020-04-23. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker to execute arbitrary code on the system…
CVE-2018-1786, published 2018-11-12. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service.…
CVE-2022-22394, published 2022-03-21. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By signing in, an attacker could exploit…
CVE-2020-4559, published 2020-08-28. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. IBM X-Force ID: 183613.
CVE-2023-27863, published 2023-05-12. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325.

Latest

CVE-2022-22484, published 2022-05-17. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the…
CVE-2021-20491, published 2021-04-16. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking during the parsing of commands. By issuing such a command with an improper…
CVE-2020-5017, published 2021-01-08. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653.