CVE-2021-29912

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828...

CVE-2021-38911

IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...

Code injection

IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...

Cross site scripting

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828...

CVE-2021-38911

IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940...

CVE-2021-38911

CVE-2021-38911 affects IBM Security Risk Manager on CP4S. The issue: credentials are stored in plain text and readable by an authenticated privileged user. Affected product/version: CP4S 1.7.2.0 of IBM Security Risk Manager on CP4S. Remediation path: upgrade to CP4S 1.7.2.0 first (if not already)...

CVE-2021-29912

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828...

CVE-2021-29912

CVE-2021-29912 affects IBM Security Risk Manager on CP4S 1.7.0.0. The vulnerability is a cross-site scripting flaw in the Web UI that can let an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected product: IBM Security Risk Manager...

Security Bulletin: IBM Security Risk Manager on CP4S is affected by multiple vulnerabilities (CVE-2020-15168, CVE-2021-29912)

Summary IBM Security Risk Manager on CP4S has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2021-29912 DESCRIPTION: IBM Cloud Pak - Risk Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus...

Security Bulletin: IBM Security Risk Manager on CP4S is affected by multiple vulnerabilities

Summary IBM Security Risk Manager on CP4S has addressed the following vulnerabilities: Vulnerability Details CVEID: CVE-2020-5421 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a...

CVE-2021-29912

IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828...

CVE-2021-29894

CVE-2021-29894 affects IBM Cloud Pak for Security (CP4S) versions 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. A remediation is available: upgrade to CP4S 1.8.0.0 following IBM’s upgrad...

CVE-2021-20578

CVE-2021-20578 affects IBM Cloud Pak for Security (CP4S) versions 1.7.0.0, 1.7.1.0, 1.7.2.0 and 1.8.0.0, where improper or missing authentication controls could permit an attacker to perform unauthorized actions. The connected IBM bulletin confirms CP4S vulnerability details and provides remediat...

CVE-2021-29696

IBM Cloud Pak for Security CP4S 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

CVE-2021-29697

CVE-2021-29697 affects IBM Cloud Pak for Security (CP4S) releases 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0. The issue enables a remote authenticated attacker to disclose sensitive information via HTTP requests, potentially enabling further attacks. Affected component/underlying ca...

CVE-2021-29696

CVE-2021-29696 affects IBM Cloud Pak for Security (CP4S) versions 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0. A remote authenticated attacker could execute arbitrary commands on the system by sending a specially crafted request. The vulnerability is documented across multiple source...

CVE-2021-20541

CVE-2021-20541 affects IBM Cloud Pak for Security (CP4S) versions 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0.** An information-disclosure vulnerability allows an unauthenticated/unauthorized user to obtain sensitive data via HTTP GET requests, which could be leveraged for further at...

CVE-2021-20540

CVE-2021-20540 affects IBM Cloud Pak for Security (CP4S) versions 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0. The issue allows an unauthorized user to disclose sensitive information via HTTP GET requests. This disclosure could be used for further attacks on the system. IBM documenta...

CVE-2021-20539

CVE-2021-20539 affects IBM Cloud Pak for Security (CP4S) versions 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0. It permits an information disclosure vulnerability where an unauthorized user could obtain sensitive data via HTTP GET requests. The risk is limited to disclosure; no exploi...

CVE-2021-20565

Summary of CVE-2021-20565 (IBM Cloud Pak for Security CP4S) CP4S versions affected: 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1. The issue is a logic vulnerability in the protection mechanism that relies on the existence or value of input data. An untrusted actor can modify the input in a way...