DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM Spectrum Protect: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2022-06-29
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, seine Rechte zu erweitern oder beliebigen Code mit Root-Rechten auszuführen.
01
beschreibt (51)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-22942US | high7.8 | Exploit | ||
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangl… | ||||
| CVE-2021-38561US | high7.5 | — | ||
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing un… | ||||
| CVE-2021-43565US | high7.5 | — | ||
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. | ||||
| CVE-2022-0850US | high7.1 | — | ||
A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. | ||||
| CVE-2021-3669US | medium5.5 | — | ||
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS. | ||||
| CVE-2021-4155US | medium5.5 | — | ||
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to le… | ||||
| CVE-2021-4028US | high7.8 | — | ||
A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a socket to listen on a high port allowing f… | ||||
| CVE-2021-3764US | medium5.5 | — | ||
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CV… | ||||
| CVE-2022-22496US | medium6.5 | — | ||
While a user account for the IBM Spectrum Protect Server 8.1.0.000 through 8.1.14 is being established, it may be configured to use SESSIONSECURITY=TRANSITIONAL. While in this mode… | ||||
| CVE-2022-22494US | medium5.3 | — | ||
IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14 could allow a remote attacker to gain details of the database, such as type and version, by sending a specially-craf… | ||||
| CVE-2022-22487US | critical9.8 | — | ||
An IBM Spectrum Protect storage agent could allow a remote attacker to perform a brute force attack by allowing unlimited attempts to login to the storage agent without locking the… | ||||
| CVE-2022-22478US | medium5.5OT erhöht | — | ||
IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886. | ||||
| CVE-2022-22474US | high7.5 | — | ||
IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of servi… | ||||
| CVE-2022-22472US | high8.8 | — | ||
IBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow a remote attacker to… | ||||
| CVE-2022-28327US | high7.5 | — | ||
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. | ||||
| CVE-2022-27536US | high7.5 | — | ||
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to… | ||||
| CVE-2022-24675US | high7.5 | Exploit | ||
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. | ||||
| CVE-2022-24842US | high8.8 | — | ||
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accou… | ||||
| CVE-2021-4203US | medium6.8 | — | ||
A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this fl… | ||||
| CVE-2021-4157US | high8.0 | — | ||
An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, havi… | ||||
20 von 51 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Amazon Linux Security Advisory ALAS2KERNEL-5.4-2022-027 vom 2022-07-21external
- Amazon Linux Security Advisory ALAS2KERNEL-5.4-2022-029 vom 2022-07-21external
- Ubuntu Security Notice USN-6151-1 vom 2023-06-09external
- WID-SEC-W-2022-0515 - CSAF Versionself
- WID-SEC-2022-0515 - Portal Versionself
- Ubuntu Security Notice USN-5984-1 vom 2023-03-29external
- IBM Security Bulletin 6618019 vom 2022-09-03external
- IBM Security Advisory vom 2022-06-29external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan