CVE-2020-4816

CVE-2020-4816 affects IBM Cloud Pak for Security (CP4S) 1.4.0.0, where failure to properly enable HTTP Strict Transport Security can allow a remote attacker to disclose sensitive information via man-in-the-middle techniques. The issue is documented by IBM and related CVSS vectors indicate user im...

CVE-2020-4628

IBM Cloud Pak for Security (CP4S) versions 1.3.0.1 and 1.4.0.0 are affected by an information disclosure vulnerability where detailed browser error messages leak sensitive information. The root cause is exposure of internal details via error messages, which could enable further attacks. Remediati...

CVE-2020-4628

IBM Cloud Pak for Security CP4S 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369...

CVE-2020-4967: Exposure of Sensitive Information to an Unauthorized Actor

IBM Cloud Pak for Security CP4S 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425...

PT-2021-12258

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security CP4S version 1.3.0.1 Description The issue could disclose sensitive information through HTTP headers, which could be used in further attacks against the system. Recommendations For IBM Cloud Pak for Security CP4S...

PT-2021-12186

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security CP4S version 1.4.0.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2021-12185

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security CP4S version 1.4.0.0 Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle techniques...

IBM Cloud Pak for Security(CPS) 信息泄露漏洞

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.4.0.0. The vulnerability stems from a failure to properly...

IBM Cloud Pak for Security 跨站脚本漏洞

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. A cross-site scripting vulnerability exists in IBM Cloud Pak for Security 1.4.0.0. The vulnerability can be exploited by a user to embed...

IBM Cloud Pak for Security(CPS) 信息泄露漏洞

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.3.0.1. An attacker could exploit this vulnerability to...

CVE-2020-4816: Missing Authorization

IBM Cloud Pak for Security CP4S 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM...

CVE-2020-4820: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Security CP4S 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2020-4815: Exposure of Sensitive Information to an Unauthorized Actor

IBM Cloud Pak for Security CP4S 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system...

PT-2021-12184

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security CP4S version 1.4.0.0 Description The issue allows a remote user to obtain sensitive information from HTTP response headers, which could be used in further attacks against the system. Recommendations For IBM Cloud Pak...

IBM Cloud Pak for Security 安全漏洞

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.4.0.0. An attacker could exploit this vulnerability to...

CVE-2020-4628: Generation of Error Message Containing Sensitive Information

IBM Cloud Pak for Security CP4S 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369...

IBM Cloud Pak for Security 安全漏洞

IBM Cloud Pak for Security is an integrated security tool that uses a unified interface to provide deep insight into threats in hybrid multi-cloud environments. An information disclosure vulnerability exists in IBM Cloud Pak for Security 1.3.0.1, 1.4.0.0. An attacker could exploit the vulnerabili...

PT-2021-12144

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security CP4S versions 1.3.0.1 through 1.4.0.0 Description The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used ...

Security Bulletin: IBM Cloud Pak for Security could allow a remote user to obtain sensitive information from HTTP response headers (CVE-2020-4815)

Summary In Cloud Pak for Security 1.4.0.0, a remote user may be able to obtain sensitive information from HTTP response that could be utilised by an attacker. This has been addressed in an update. Vulnerability Details CVEID: CVE-2020-4815 DESCRIPTION: IBM Cloud Pak for Security CP4S could allow ...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to cross-site scripting (CVE-2020-4820)

Summary IBM Cloud Pak for Security CP4S version 1.4.0.0 and earlier is vulnerable to cross-site scripting, potentially leading to a disclosure of credentials within a trusted session. The issue has been addressed in an update. Vulnerability Details CVEID: CVE-2020-4820 DESCRIPTION: IBM Cloud Pak...