CVE-2021-20577

IBM Cloud Pak for Security CP4S 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2021-20538

IBM Cloud Pak for Security CP4S 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919...

CVE-2021-20538

Affected product: IBM Cloud Pak for Security (CP4S) infers CP4S 1.5.0.0 and 1.5.0.1. Vulnerability: incorrect authorization could allow a user to obtain sensitive information or perform actions they should not have access to. Root cause (as stated): improper authorization mechanisms. Impact: pote...

Unspecified Vulnerability in IBM Cloud Pak for Security

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A security vulnerability exists in IBM Cloud Pak for Security versions 1.5.0.0 and...

IBM Cloud Pak for Security Cross-Site Scripting Vulnerability (CNVD-2021-34348)

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A cross-site scripting vulnerability exists in IBM Cloud Pak for Security versions...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to CVE-2021-20538 and CVE-2021-20577

Summary IBM Cloud Pak for Security versions 1.5.0.1 and earlier is vulnerable to the following CVEs: CVE-2021-20538, meaning that sensitive information can be obtained by the user without sufficient authorisation. CVE-2021-20577, allowing cross side scripting that can potentially lead to...

Security Bulletin: A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management.

Summary A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management. Vulnerability Details CVEID: CVE-2020-26291 DESCRIPTION: Node.js urijs module could allow a remote attacker to conduct spoofing attacks, caused by improper input...

IBM Cloud Pak for Security 跨站脚本漏洞

IBM Cloud Pak for Security is an application from IBM America, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. IBM Cloud Pak for Security suffers from a cross-site scripting vulnerability that...

IBM Cloud Pak for Security 安全漏洞

IBM Cloud Pak for Security is an application from IBM America, Inc. An open security platform that connects to your existing data sources to generate deeper insights and enables you to take automated action faster. A security vulnerability exists in IBM Cloud Pak for Security that stems from an...

Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by CVE-2021-3177

Summary IBM Watson OpenScale on Cloud Pak for Data has addressed CVE-2021-3177. Vulnerability Details CVEID: CVE-2021-3177 DESCRIPTION: Python is vulnerable to a buffer overflow, caused by improper bounds checking by the PyCArgrepr function in ctypes/callproc.c. By sending specially-crafted...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK addressed in IBM Cloud Pak System (April 2020 updates)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition used in IBM Cloud Pak System. These issues were disclosed as part of the IBM Java SDK quarterly April 2020 CPU updates. IBM Cloud Pak System addressed vulnerabilities. Vulnerability Details CVEID: CVE-2020-2604...

Security Bulletin: WebSphere Application Server Traditional, which is bundled with IBM Cloud Pak for Applications, is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20454)

Summary WebSphere Application Server Traditional, which is bundled with IBM Cloud Pak for Applications, is vulnerable to an XML External Entity XXE Injection vulnerability CVE-2021-20454 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Product...

Security Bulletin: WebSphere Application Server Traditional, which is bundled with IBM Cloud Pak for Applications, is vulnerable to an XML External Entity (XXE) Injection vulnerability (CVE-2021-20453)

Summary WebSphere Application Server Traditional, which is bundled with IBM Cloud Pak for Applications, is vulnerable to an XML External Entity XXE Injection vulnerability CVE-2021-20453 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Product...

Security Bulletin: IBM Cloud Pak for Multicloud Management Managed Service Content Runtime is affected by an issue with Docker before 19.03.15.

Summary IBM Cloud Pak for Multicloud Management Managed Service Content Runtime is affected by an issue with Docker before 19.03.15. as described in CVE-2021-21284 and CVE-2021-21285. If you have IBM Cloud Pak for Multicloud Management Managed Service Content Runtime with docker engine 19.03.14 o...

Security Bulletin: Vulnerability identified in WebSphere Application Server affects Cloud Pak System (CVE-2019-12406)

Summary Vulnerability in Apache MyFaces identified in WebSphere Application Server shipped with IBM Cloud Pak System. Information about vulnerability has been published in security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected...

Security Bulletin: WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo (CVE-2020-5258)

Summary WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, contains a vulnerability in Dojo CVE-2020-5258 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Affected Products and...

Security Bulletin: WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to a Server-side Request Forgery vulnerability (CVE-2021-20480)

Summary WebSphere Application Server, which is bundled in IBM Cloud Pak for Applications, is vulnerable to a Server-side Request Forgery vulnerability CVE-2021-20480 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, contains a vulnerability in Apache MyFaces (CVE-2021-26296)

Summary WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, contains a vulnerability in Apache MyFaces CVE-2021-26296 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Principal Affected...

Security Bulletin: WebSphere Application Server, which is a component of IBM Cloud Pak for Aplications, is vulnerable to a Directory Traversal vulnerability (CVE-2020-5016)

Summary WebSphere Application Server is shipped as a component of IBM Cloud Pak for Applications. Information about security vulnerabilities affecting WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Watson OpenScale on Cloud Pak for Data is impacted by Vulnerabilities in Node.js

Summary IBM Watson OpenScale on Cloud Pak for Data has addressed CVE-2021-23337, CVE-2021-23327, CVE-2021-23334, CVE-2021-27191, CVE-2021-23335. Vulnerability Details CVEID: CVE-2021-23337 DESCRIPTION: Node.js lodash module could allow a remote authenticated attacker to execute arbitrary commands...