High WID-SEC-2025-2471 9 CVEs

IBM Spectrum Protect Plus: Mehrere Schwachstellen

Published Jan 31, 2022 · Updated Nov 3, 2025 · Revision 2 · de-DE

Vendor: IBM Product: Spectrum Protect Product: Storage Scale Platform: Linux

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM Spectrum Protect ausnutzen, um Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und beliebigen Code auszuführen.

Product

IBM Spectrum Protect ist eine zentralisierte Backuplösung für Systeme im Netzwerk.

Vulnerabilities 9

Medium 6.6

CVE-2021-44832 Public exploit EPSS 98%

Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 28, 2021
Low 3.1

CVE-2021-23445

Cross-site Scripting (XSS)

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

reaper datatables.net datatables.js datatables.js Debian Ubuntu Azure Linux npm

Sep 27, 2021
Unscored —

CVE-2021-22959

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…

Node.js node nodejs nodejs Debian Alpine

Nov 15, 2021
Unscored —

CVE-2021-22960

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…

Node.js node nodejs nodejs Debian Alpine

Nov 3, 2021
Unscored —

CVE-2021-23214

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, …

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

Mar 4, 2022
Unscored —

CVE-2021-44531

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …

Node.js node openjdk11 nodejs Debian Azure Linux Alpine

Feb 24, 2022
Unscored —

CVE-2021-44532 EPSS 10%

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …

Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine

Feb 24, 2022
Unscored —

CVE-2021-44533

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…

Node.js node nodejs openjdk11 Debian Ubuntu Azure Linux Alpine

Feb 24, 2022
Unscored —

CVE-2022-21824 EPSS 22%

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

Node.js node openjdk11 nodejs Debian Azure Linux Alpine

Feb 24, 2022

Revision history

2025-11-03 #2
Neue Updates von IBM aufgenommen
2022-01-31 #1
Initiale Fassung

References

IBM Security Advisory vom 2022-01-31
https://www.ibm.com/support/pages/node/6552188
IBM Security Advisory vom 2022-01-31
https://www.ibm.com/support/pages/node/6540856
IBM Security Bulletin 7250083 vom 2025-11-04
https://www.ibm.com/support/pages/node/7250083