Search
Find a vulnerability
Search criteria
8 vulnerabilities found for Spectrum Control Standard Edition by IBM
CVE-2019-4138 (GCVE-0-2019-4138)
Vulnerability from nvd – Published: 2019-05-29 15:10 – Updated: 2024-09-16 23:45
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334.
Severity
CWE
- Obtain Information
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10880375 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/108533 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.13
Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 Affected: 5.2.17.2 Affected: 5.3.0.1 Affected: 5.3.15.3.2 |
Date Public
2019-05-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
},
{
"status": "affected",
"version": "5.2.17.2"
},
{
"status": "affected",
"version": "5.3.0.1"
},
{
"status": "affected",
"version": "5.3.15.3.2"
}
]
}
],
"datePublic": "2019-05-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/S:U/UI:N/C:H/A:N/I:N/AC:H/PR:N/AV:N/E:U/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T06:06:02.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-23T00:00:00",
"ID": "CVE-2019-4138",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
},
{
"version_value": "5.2.17.2"
},
{
"version_value": "5.3.0.1"
},
{
"version_value": "5.3.15.3.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "H",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10880375",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 880375 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108533"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4138",
"datePublished": "2019-05-29T15:10:24.210Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:45:37.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4137 (GCVE-0-2019-4137)
Vulnerability from nvd – Published: 2019-05-29 15:10 – Updated: 2024-09-17 01:51
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333.
Severity
CWE
- Cross-Site Scripting
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10880375 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/108533 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.13
Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 Affected: 5.2.17.2 Affected: 5.3.0.1 Affected: 5.3.15.3.2 |
Date Public
2019-05-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:28.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
},
{
"status": "affected",
"version": "5.2.17.2"
},
{
"status": "affected",
"version": "5.3.0.1"
},
{
"status": "affected",
"version": "5.3.15.3.2"
}
]
}
],
"datePublic": "2019-05-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/PR:N/AC:L/I:L/A:N/C:L/S:C/UI:R/RL:O/RC:C/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T06:06:02.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-23T00:00:00",
"ID": "CVE-2019-4137",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
},
{
"version_value": "5.2.17.2"
},
{
"version_value": "5.3.0.1"
},
{
"version_value": "5.3.15.3.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10880375",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 880375 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108533"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4137",
"datePublished": "2019-05-29T15:10:24.137Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:58.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4072 (GCVE-0-2019-4072)
Vulnerability from nvd – Published: 2019-05-09 15:10 – Updated: 2024-09-17 03:08
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.
Severity
CWE
- Gain Access
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10873036 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.1
Affected: 5.2.8 Affected: 5.2.11 Affected: 5.2.12 Affected: 5.2.13 Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.10.1 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 |
Date Public
2019-05-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.8"
},
{
"status": "affected",
"version": "5.2.11"
},
{
"status": "affected",
"version": "5.2.12"
},
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.10.1"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
}
]
}
],
"datePublic": "2019-05-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:L/S:U/AV:N/A:L/C:L/PR:H/UI:N/I:L/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-09T15:10:15.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-07T00:00:00",
"ID": "CVE-2019-4072",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.1"
},
{
"version_value": "5.2.8"
},
{
"version_value": "5.2.11"
},
{
"version_value": "5.2.12"
},
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.10.1"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "H",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10873036",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 873036 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4072",
"datePublished": "2019-05-09T15:10:15.606Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:08:21.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4071 (GCVE-0-2019-4071)
Vulnerability from nvd – Published: 2019-05-09 15:10 – Updated: 2024-09-16 22:40
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063.
Severity
CWE
- Gain Access
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10872900 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.1
Affected: 5.2.8 Affected: 5.2.11 Affected: 5.2.12 Affected: 5.2.13 Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.10.1 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 |
Date Public
2019-05-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.8"
},
{
"status": "affected",
"version": "5.2.11"
},
{
"status": "affected",
"version": "5.2.12"
},
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.10.1"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
}
]
}
],
"datePublic": "2019-05-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/I:H/PR:H/UI:R/AV:N/S:U/C:H/A:H/AC:L/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-09T15:10:15.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-07T00:00:00",
"ID": "CVE-2019-4071",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.1"
},
{
"version_value": "5.2.8"
},
{
"version_value": "5.2.11"
},
{
"version_value": "5.2.12"
},
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.10.1"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "H",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10872900",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 872900 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4071",
"datePublished": "2019-05-09T15:10:15.559Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:40:47.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4138 (GCVE-0-2019-4138)
Vulnerability from cvelistv5 – Published: 2019-05-29 15:10 – Updated: 2024-09-16 23:45
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334.
Severity
CWE
- Obtain Information
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10880375 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/108533 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.13
Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 Affected: 5.2.17.2 Affected: 5.3.0.1 Affected: 5.3.15.3.2 |
Date Public
2019-05-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
},
{
"status": "affected",
"version": "5.2.17.2"
},
{
"status": "affected",
"version": "5.3.0.1"
},
{
"status": "affected",
"version": "5.3.15.3.2"
}
]
}
],
"datePublic": "2019-05-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/S:U/UI:N/C:H/A:N/I:N/AC:H/PR:N/AV:N/E:U/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T06:06:02.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-23T00:00:00",
"ID": "CVE-2019-4138",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
},
{
"version_value": "5.2.17.2"
},
{
"version_value": "5.3.0.1"
},
{
"version_value": "5.3.15.3.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 158334."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "H",
"AV": "N",
"C": "H",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10880375",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 880375 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194138-info-disc (158334)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158334"
},
{
"name": "108533",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108533"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4138",
"datePublished": "2019-05-29T15:10:24.210Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:45:37.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4137 (GCVE-0-2019-4137)
Vulnerability from cvelistv5 – Published: 2019-05-29 15:10 – Updated: 2024-09-17 01:51
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333.
Severity
CWE
- Cross-Site Scripting
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10880375 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/108533 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.13
Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 Affected: 5.2.17.2 Affected: 5.3.0.1 Affected: 5.3.15.3.2 |
Date Public
2019-05-23 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:28.134Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
},
{
"status": "affected",
"version": "5.2.17.2"
},
{
"status": "affected",
"version": "5.3.0.1"
},
{
"status": "affected",
"version": "5.3.15.3.2"
}
]
}
],
"datePublic": "2019-05-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/PR:N/AC:L/I:L/A:N/C:L/S:C/UI:R/RL:O/RC:C/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-03T06:06:02.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/108533"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-23T00:00:00",
"ID": "CVE-2019-4137",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
},
{
"version_value": "5.2.17.2"
},
{
"version_value": "5.3.0.1"
},
{
"version_value": "5.3.15.3.2"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center 5.2.13 through 5.3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158333."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10880375",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 880375 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10880375"
},
{
"name": "ibm-tivoli-cve20194137-xss (158333)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/158333"
},
{
"name": "108533",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/108533"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4137",
"datePublished": "2019-05-29T15:10:24.137Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:51:58.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4072 (GCVE-0-2019-4072)
Vulnerability from cvelistv5 – Published: 2019-05-09 15:10 – Updated: 2024-09-17 03:08
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064.
Severity
CWE
- Gain Access
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10873036 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.1
Affected: 5.2.8 Affected: 5.2.11 Affected: 5.2.12 Affected: 5.2.13 Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.10.1 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 |
Date Public
2019-05-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.999Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.8"
},
{
"status": "affected",
"version": "5.2.11"
},
{
"status": "affected",
"version": "5.2.12"
},
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.10.1"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
}
]
}
],
"datePublic": "2019-05-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:L/S:U/AV:N/A:L/C:L/PR:H/UI:N/I:L/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-09T15:10:15.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-07T00:00:00",
"ID": "CVE-2019-4072",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.1"
},
{
"version_value": "5.2.8"
},
{
"version_value": "5.2.11"
},
{
"version_value": "5.2.12"
},
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.10.1"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to remain idle within the application even when a user has logged out. Utilizing the application back button users can remain logged in as the current user for a short period of time, therefore users are presented with information for Spectrum Control Application. IBM X-Force ID: 157064."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "L",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "H",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10873036",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 873036 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10873036"
},
{
"name": "ibm-tivoli-cve20194072-session-fixation (157064)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157064"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4072",
"datePublished": "2019-05-09T15:10:15.606Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:08:21.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-4071 (GCVE-0-2019-4071)
Vulnerability from cvelistv5 – Published: 2019-05-09 15:10 – Updated: 2024-09-16 22:40
VLAI
EPSS
VEX
Summary
IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063.
Severity
CWE
- Gain Access
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.ibm.com/support/docview.wss?uid=ibm10872900 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Spectrum Control Standard Edition |
Affected:
5.2.1
Affected: 5.2.8 Affected: 5.2.11 Affected: 5.2.12 Affected: 5.2.13 Affected: 5.2.14 Affected: 5.2.15 Affected: 5.2.16 Affected: 5.2.10.1 Affected: 5.2.15.2 Affected: 5.2.17.0 Affected: 5.2.17.1 |
Date Public
2019-05-07 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:26:27.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Spectrum Control Standard Edition",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.8"
},
{
"status": "affected",
"version": "5.2.11"
},
{
"status": "affected",
"version": "5.2.12"
},
{
"status": "affected",
"version": "5.2.13"
},
{
"status": "affected",
"version": "5.2.14"
},
{
"status": "affected",
"version": "5.2.15"
},
{
"status": "affected",
"version": "5.2.16"
},
{
"status": "affected",
"version": "5.2.10.1"
},
{
"status": "affected",
"version": "5.2.15.2"
},
{
"status": "affected",
"version": "5.2.17.0"
},
{
"status": "affected",
"version": "5.2.17.1"
}
]
}
],
"datePublic": "2019-05-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/I:H/PR:H/UI:R/AV:N/S:U/C:H/A:H/AC:L/E:U/RL:O/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Access",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-09T15:10:15.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2019-05-07T00:00:00",
"ID": "CVE-2019-4071",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Spectrum Control Standard Edition",
"version": {
"version_data": [
{
"version_value": "5.2.1"
},
{
"version_value": "5.2.8"
},
{
"version_value": "5.2.11"
},
{
"version_value": "5.2.12"
},
{
"version_value": "5.2.13"
},
{
"version_value": "5.2.14"
},
{
"version_value": "5.2.15"
},
{
"version_value": "5.2.16"
},
{
"version_value": "5.2.10.1"
},
{
"version_value": "5.2.15.2"
},
{
"version_value": "5.2.17.0"
},
{
"version_value": "5.2.17.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "H",
"S": "U",
"UI": "R"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Access"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10872900",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 872900 (Spectrum Control Standard Edition)",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10872900"
},
{
"name": "ibm-tivoli-cve20194071-csv-injection (157063)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/157063"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2019-4071",
"datePublished": "2019-05-09T15:10:15.559Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:40:47.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}