IBM Spectrum Protect Plus vulnerabilities

44 CVEs affecting IBM Spectrum Protect Plus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-47148, published 2024-02-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4241, published 2020-03-31. High severity, CVSS 8.8. EPSS: 66.3% chance of exploitation in the next 30 days. IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request,…
CVE-2020-4469, published 2020-06-15. Critical severity, CVSS 9.8. EPSS: 13.4% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this…
CVE-2020-4206, published 2020-03-31. High severity, CVSS 8.8. EPSS: 4.6% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper validation of user-supplied…
CVE-2020-4242, published 2020-03-31. High severity, CVSS 8.8. EPSS: 4.6% chance of exploitation in the next 30 days. IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request,…
CVE-2020-4471, published 2020-06-15. Medium severity, CVSS 6.5. EPSS: 2.7% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an unauthenticated attacker to cause a denial of service or hijack DNS sessions by send a specially crafted HTTP command to the remote…
CVE-2020-4711, published 2020-09-15. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot"…
CVE-2020-4854, published 2020-11-23. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to…
CVE-2020-5023, published 2021-02-10. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash due to excess resource consumption. IBM X-Force ID: 193659.
CVE-2020-4240, published 2020-03-31. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to overwrite or create…
CVE-2020-4470, published 2020-06-15. High severity, CVSS 8.0. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the vulnerable server.…

Latest

CVE-2023-47148, published 2024-02-02. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be…
CVE-2020-4497, published 2022-12-14. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An…
CVE-2022-40608, published 2022-09-19. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory traversal attack. This…
CVE-2022-40234, published 2022-09-19. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Versions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM…
CVE-2021-3669, published 2022-08-26. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
CVE-2022-22396, published 2022-06-06. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP…
CVE-2022-22354, published 2022-03-14. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP…
CVE-2021-39063, published 2021-12-13. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information due to a…
CVE-2021-39057, published 2021-12-13. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system,…
CVE-2020-4496, published 2021-12-13. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate…