Ibm Spectrum Virtualize vulnerabilities

17 known vulnerabilities affecting ibm/spectrum_virtualize.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL1HIGH8MEDIUM8

Vulnerabilities

Page 1 of 1

CVE-2023-25681MEDIUMCVSS 6.5v8.5.0.0v8.52024-03-05

CVE-2023-25681 [MEDIUM] CWE-308 CVE-2023-25681: LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect local users with MFA configured or remote users authenticating via single sign-on. IBM X-Force ID: 247033.

cvelistv5nvd

CVE-2023-27870HIGHCVSS 7.5v8.52023-05-11

CVE-2023-27870 [MEDIUM] CWE-200 CVE-2023-27870: IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential infor IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518.

cvelistv5nvd

CVE-2022-43873HIGHCVSS 8.8v8.2.0.0v8.3.0.0+3 more2023-02-22

CVE-2022-43873 [MEDIUM] CVE-2022-43873: An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the system. IBM X-Force ID: 239847.

cvelistv5nvd

CVE-2022-43870MEDIUMCVSS 6.5v8.3.0.0v8.4.0.0+2 more2023-02-22

CVE-2022-43870 [MEDIUM] CWE-532 CVE-2022-43870: IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticat IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540.

cvelistv5nvd

CVE-2022-39167MEDIUMCVSS 5.9v7.8.0.0v8.2.0.0+4 more2023-01-19

CVE-2022-39167 [MEDIUM] CWE-200 CVE-2022-39167: IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose s IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.

cvelistv5nvd

CVE-2021-38969CRITICALCVSS 9.8v8.2.0.0v8.3.0.0+4 more2022-05-11

CVE-2021-38969 [CRITICAL] CWE-798 CVE-2021-38969: IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due t IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.

cvelistv5nvd

CVE-2021-29873HIGHCVSS 8.1≥ 7.8.0.0, < 8.4.0.02021-10-21

CVE-2021-29873 [HIGH] CVE-2021-29873: IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.

nvd

CVE-2020-4686HIGHCVSS 8.1v8.3.12020-08-17

CVE-2020-4686 [HIGH] CVE-2020-4686: IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their pri IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678.

nvd

CVE-2018-1438HIGHCVSS 7.5≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1438 [HIGH] CWE-200 CVE-2018-1438: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566.

nvd

CVE-2018-1433HIGHCVSS 7.5≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1433 [HIGH] CWE-200 CVE-2018-1433: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.

nvd

CVE-2018-1434HIGHCVSS 8.8≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1434 [HIGH] CWE-352 CVE-2018-1434: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website

nvd

CVE-2018-1462HIGHCVSS 7.6≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1462 [HIGH] CWE-863 CVE-2018-1462: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to including deleting files or causing a denial of service. IBM X-Force ID: 1

nvd

CVE-2018-1463MEDIUMCVSS 6.5≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1463 [MEDIUM] CWE-863 CVE-2018-1463: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to some of which could contain account credentials. IBM X-Force ID: 140368.

nvd

CVE-2018-1464MEDIUMCVSS 6.5≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1464 [MEDIUM] CWE-200 CVE-2018-1464: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to obtain sensitive information that they should not have authorization to read. IBM X-Force ID: 140395.

nvd

CVE-2018-1461MEDIUMCVSS 5.4≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1461 [MEDIUM] CWE-79 CVE-2018-1461: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality

nvd

CVE-2018-1465MEDIUMCVSS 5.3≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1465 [MEDIUM] CWE-200 CVE-2018-1465: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to obtain the private key which could make intercepting GUI communications possible. IBM X-Force ID: 140396.

nvd

CVE-2018-1466MEDIUMCVSS 5.3≥ 6.1.0.0, < 7.5.0.14≥ 7.7.0.0, < 7.7.1.9+3 more2018-05-17

CVE-2018-1466 [MEDIUM] CWE-326 CVE-2018-1466: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.

nvd