Storage Defender - Resiliency Service vulnerabilities
6 known vulnerabilities in Storage Defender - Resiliency Service from IBM. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Storage Defender - Resiliency Service: Use of a Broken or Risky Cryptographic Algorithm
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.12 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- 7.5 High severity
Storage Defender - Resiliency Service: Missing Encryption of Sensitive Data
IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerability to obtain sensitiv
- 7.5 High severity
Storage Defender - Resiliency Service: Improper Certificate Validation
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.
- 7.5 High severity
Storage Defender - Resiliency Service: Observable Discrepancy
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
- 7.8 High severity
Storage Defender - Resiliency Service: Use of Hard-coded Credentials
IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force
- 7.2 High severity
Storage Defender - Resiliency Service: Cleartext Storage of Sensitive Information
IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage. IBM X-Force ID: 275783.