Vulnerabilities for Spectrum protect operations center (...) - CXSECURITY.COM

Vulnerabilities for
'Spectrum protect operations center'

2022-03-14

CVE-2022-22346

CWE-352

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220048.

CVE-2022-22348

CWE-352

IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 220139.

2021-12-13

CVE-2021-38901

CWE-200

IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information. IBM X-Force ID: 209610.

2021-02-15

CVE-2020-4956

CWE-400

IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156.

CVE-2020-4955

CWE-434

IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155.

CVE-2020-4954

CWE-384

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153.

2019-07-02

CVE-2019-4129

CWE-200

IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to obtain sensitive information, caused by an error message containing a stack trace. By creating an error with a stack trace, an attacker could exploit this vulnerability to potentially obtain details on the Operations Center architecture. IBM X-Force ID: 158279.

CVE-2019-4088

CWE-264

IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents could allow a local attacker to gain elevated privileges on the system, caused by loading a specially crafted library loaded by the dsmqsan module. By setting up such a library, a local attacker could exploit this vulnerability to gain root privileges on the vulnerable system. IBM X-Force ID: 157511.

CVE-2019-4087

CWE-119

IBM Spectrum Protect Servers 7.1 and 8.1 and Storage Agents are vulnerable to a stack-based buffer overflow, caused by improper bounds checking by servers and storage agents in response to specifically crafted communication exchanges. By sending an overly long request, a remote attacker could overflow a buffer and execute arbitrary code on the system with instance id privileges or cause the server or storage agent to crash. IBM X-Force ID: 157510.

>>> Vendor: IBM 1045 Products

Communications server

Lotus domino mail server

Lotus domino server

Aix enetwork firewall

Websphere application server

Tivoli opc tracker agent

Netfinity remote control

System data repository

Navio nc browser

Network station manager

Http server ssl module common

Tivoli management framework

Db2 universal database

Websphere plugin

Net.commerce hosting server

Websphere commerce suite

High availability cluster multiprocessing

Informix web datablade

Tivoli secureway policy director

Alphaworks tftp server

Secureway directory

Lotus domino r5

Visualage for java

Tivoli storage manager

Websphere caching proxy server

Secureway firewall

Aix parallel systems support programs

Lotus notes client

Lotus domino web server

Tivoli firewall toolbox

Internet security systems blackice defender

Websphere edge server caching proxy

Informix dynamic server

Informix extended parallel server

Parallel environment

Trading partner interchange

Tivoli directory server

Tivoli access manager for e-business

Tivoli access manager identity manager solution

Tivoli configuration manager

Tivoli configuration manager for atm

Websphere everyplace server

Hardware management console

Rational clearquest

Lotus domino enterprise server

Db2 content manager

Informix dynamic database server

Lotus domino inotes client

Tivoli business systems manager

Network appliance data ontap

Lotus domino web access

Inventory scout

Client security password manager

Informix client sdk

See all Products for Vendor IBM

Copyright 2024, cxsecurity.com