DeutschShown in its original language — a full translation is planned for a future version.
IBM Spectrum Protect: Mehrere Schwachstellen
view advisory published 2022-03-13
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen 'Denial of Service'-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, einen 'Cross-Site-Scripting'-Angriff durchzuführen, beliebigen Code auszuführen, sensible Informationen offenzulegen und seine Privilegien zu erweitern.
01
describes (25)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-22354US | high7.5 | — | ||
IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a S… | ||||
| CVE-2022-22348US | low2.4 | — | ||
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to reverse tabnabbing where it could allow a page linked to from within Operations Center to rewri… | ||||
| CVE-2022-22346US | high8.8 | — | ||
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.13.xxx is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized… | ||||
| CVE-2021-23222US | medium5.9 | — | ||
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. | ||||
| CVE-2022-23806US | critical9.1 | — | ||
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. | ||||
| CVE-2022-23773US | high7.5 | Exploit | ||
cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is… | ||||
| CVE-2022-23772US | high7.5 | — | ||
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. | ||||
| CVE-2022-0391US | high7.5 | — | ||
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the… | ||||
| CVE-2021-4034US | high7.8OT critical | KEV | ||
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri… | ||||
| CVE-2022-0235US | medium6.1 | — | ||
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | ||||
| CVE-2022-21681US | high7.5 | — | ||
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead t… | ||||
| CVE-2022-21680US | high7.5 | — | ||
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular… | ||||
| CVE-2021-44717US | medium4.8 | — | ||
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file desc… | ||||
| CVE-2021-44716US | high7.5 | — | ||
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. | ||||
| CVE-2021-23727US | high7.5 | — | ||
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the da… | ||||
| CVE-2021-39002US | high7.5OT elevated | — | ||
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to… | ||||
| CVE-2021-38931US | medium6.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read acc… | ||||
| CVE-2021-38926US | medium5.5 | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privileges due to allowing modification of column… | ||||
| CVE-2021-29678US | high8.7OT elevated | — | ||
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modi… | ||||
| CVE-2021-20373US | high7.5 | — | ||
IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce… | ||||
showing 20 of 25
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2023-0426 - CSAF Versionself
- WID-SEC-2023-0426 - Portal Versionself
- IBM Security Advisory vom 2022-03-13external
- IBM Security Advisory vom 2022-03-13external
- IBM Security Advisory vom 2022-03-13external
- IBM Security Advisory vom 2022-03-13external
- IBM Security Advisory vom 2022-03-13external
- IBM Security Advisory vom 2022-03-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan