IBM Spectrum Protect Backup-Archive Client vulnerabilities

7 CVEs affecting IBM Spectrum Protect Backup-Archive Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28956, published 2023-06-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1853, published 2019-04-08. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote…
CVE-2019-4406, published 2019-11-25. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect Backup-Archive Client 7.1 and 8.1 may be vulnerable to a denial of service attack due to a timing issue between client and server TCP/IP communications. IBM X-Force ID: 162477.
CVE-2018-1787, published 2019-04-08. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872.
CVE-2021-39048, published 2021-12-13. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A local attacker could exploit this vulnerability and cause a denial of…
CVE-2018-1882, published 2019-04-08. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client trace file. IBM X-Force ID: 151968.
CVE-2021-20532, published 2021-04-26. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 could allow a local user to escalate their privileges to take full control of the system due to insecure directory permissions. IBM X-Force ID:…
CVE-2023-28956, published 2023-06-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.