CVE-2020-4928

IBM Cloud Pak System 2.3 is affected by CVE-2020-4928, where a local privileged attacker can upload arbitrary files by intercepting requests and modifying the file extension, potentially enabling arbitrary code execution on the server. The vulnerability affects the IBM Cloud Pak System 2.3 line a...

CVE-2020-4928

IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705...

CVE-2020-4919

IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395...

CVE-2020-4918

IBM Cloud Pak System 2.3 contains an information-disclosure flaw stemming from an insecure direct object reference in the Sales and Service Console of the Platform System Manager. A local privileged user could disclose sensitive data. Affected versions: Cloud Pak System 2.3 (per CVE-2020-4918). C...

CVE-2020-4918

IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392...

CVE-2020-4916

The CVE-2020-4916 entry applies to IBM Cloud Pak System 2.3, where a cross-site scripting vulnerability in the Web UI allows embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The problem is tied to the IBM Cloud Pak System 2.3 stack (Web UI co...

CVE-2020-4917

CVE-2020-4917 affects IBM Cloud Pak System 2.3 and describes a cross-site request forgery vulnerability that could let an attacker perform malicious actions on behalf of a trusted user. The issue is documented with the affected product/version and the stated impact (unauthorized actions transmitt...

CVE-2020-4917

IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391...

CVE-2020-4916

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191390...

CVE-2020-4913

IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288...

CVE-2020-4910

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting in the Web UI, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected product/version: IBM Cloud Pak System 2.3. Remediation: upgrade to Cloud Pak System v2.3.3.3 (pe...

CVE-2020-4912

IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287...

CVE-2020-4912

CVE-2020-4912 affects IBM Cloud Pak System 2.3, specifically the Self Service Console. The vulnerability allows privilege escalation by capturing the user request URL when a privileged user is logged in. This is supported by multiple sources in the connected set (NVD entry for CVE-2020-4912 and C...

CVE-2020-4910

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274...

CVE-2020-4909

CVE-2020-4909 affects IBM Cloud Pak System 2.3. It describes a cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected product: IBM Cloud Pak System 2.3. Remediation provided...

CVE-2020-4909

IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273...

IBM Cloud Pak System 跨站脚本漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. A cross-site scripting vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability to embed arbitrary JavaScript code in the Web UI that could...

IBM Cloud Pak System 安全漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An elevation of privilege vulnerability exists in the self-service console of IBM Cloud Pak System 2.3. An attacker could exploit the vulnerability by capturing a user request U...

IBM Cloud Pak System 信息泄露漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An information disclosure vulnerability exists in IBM Cloud Pak System 2.3. An attacker could exploit this vulnerability to obtain credential information from an HTTP response...

IBM Cloud Pak System 代码问题漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. An arbitrary file upload vulnerability exists in IBM Cloud Pak System 2.3. An attacker can exploit this vulnerability by intercepting requests and modifying the file extension t...