Cloud Pak For Security

cloud_pak_for_security

Vendor: Ibm • 53 CVEs

CVEs (53)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-4811 1Ibm 1Cloud Pak For Security Jun 17, 2026 May 14, 2021 N/A· v4 2.4 LOW· v3 4.0 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation.
CVE-2021-20577 1Ibm 1Cloud Pak For Security Jun 17, 2026 May 10, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality poten...Show more IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281.Show less
CVE-2021-20538 1Ibm 1Cloud Pak For Security Jun 17, 2026 May 10, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919...Show more IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.Show less
CVE-2020-4967 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425.
CVE-2020-4820 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...Show more IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.Show less
CVE-2020-4816 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerabili...Show more IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.Show less
CVE-2020-4815 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628 1Ibm 1Cloud Pak For Security Jun 17, 2026 Jan 27, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in fu...Show more IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.Show less
CVE-2020-4696 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session. IBM X-Force ID: 186789.
CVE-2020-4627 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 9.0 CRITICAL· v3 9.0 HIGH· v2 IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 1853...Show more IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367.Show less
CVE-2020-4626 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362.
CVE-2020-4625 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensiti...Show more IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.Show less
CVE-2020-4624 1Ibm 1Cloud Pak For Security Jun 17, 2026 Nov 30, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.

Previous 1 23