44085 matches found
PT-2026-120142
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An unauthenticated user can perform an arbitrary write into the shared Redis instance under any tenant's key. This issue breaks the credential-encryption boundary of the platform,...
PT-2026-118320
Name of the Vulnerable Software and Affected Versions Cloud Shell versions prior to 2026-07-22 Description A Cross-Site WebSocket Hijacking flaw allows an unauthenticated attacker to hijack an active session and exfiltrate the user's OAuth access token. This is achieved through a cross-origin...
CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry
Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...
CVE-2026-59386 - credential exposure to space supporter | Cloud Foundry
Severity High CVSS score: 6.4 Medium CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.247.0 inclusive Description A SpaceSupporter could change the start command and buildpack of an applicatio...
CVE-2026-59388 - Cloud Controller exposes secrets in audit log | Cloud Foundry
Severity High CVSS score: 6.5 Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.248.0 inclusive Description Credentials for custom buildpacks leaked into audit events of type...
Alibaba Cloud Linux 3 : 0311: tomcat (ALINUX3-SA-2026:0311)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0311 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-52316: Unchecked Error Condition...
CVE-2026-8355
IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5 are vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) during OAuth-enabled gateway registration. The root cause is a failure to validate the oauth_config.token_url parameter when using client_credentials authentication. This all...
CVE-2026-8355 IBM ContextForge MCP Gateway is affected by server-side request forgery
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...
spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE
//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...
spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE
//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...
CVE-2026-4418
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2026-3161
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
CVE-2026-3295
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing...
CVE-2023-38375
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2023-38375 IBM Cloud Pak System Cross-Site Scripting
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
EUVD-2023-60720
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2023-38375
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to cross-site scripting (XSS) (CWE-79). This flaw allows users to embed arbitrary JavaScript code within the Web UI, which can alter intended functionality and potentially lead to credentials disclosure during a trusted session. The...
CVE-2026-3161 IBM Cloud Pak System Risky Cryptographic Algorithm
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...
CVE-2026-3161
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 are vulnerable to the use of weaker than expected cryptographic algorithms (CWE-327). This flaw could enable an attacker to decrypt highly sensitive information. Impact is rated as High for confidentiality. To remediate this vulnerability, IBM str...