IBM Spectrum Protect Snapshot vulnerabilities

3 CVEs affecting IBM Spectrum Protect Snapshot, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-1447, published 2018-04-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7426, published 2016-01-02. Critical severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0…
CVE-2015-7429, published 2016-01-02. High severity, CVSS 8.5. EPSS: 1% chance of exploitation in the next 30 days. The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.4 and…
CVE-2018-1447, published 2018-04-04. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of…