CVE-2021-20564

CVE-2021-20564 affects IBM Cloud Pak for Security (CP4S) versions 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0 and 1.6.0.1, where a failure to properly enable HTTP Strict Transport Security can allow a remote attacker to obtain sensitive information via MITM. The vulnerability is an information disclosure ...

CVE-2020-4811

IBM Cloud Pak for Security CP4S 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation...

CVE-2020-4811

CVE-2020-4811 affects IBM Cloud Pak for Security (CP4S) versions 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1. Root cause is improper input validation that allows a privileged user to inject malicious data via a specially crafted HTTP request. Impact details in the documents indicate potential...

CVE-2021-20577

IBM Cloud Pak for Security CP4S 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2021-20577

IBM Cloud Pak for Security CP4S 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2021-20577

IBM Cloud Pak for Security (CP4S) versions 1.5.0.0 and 1.5.0.1 are vulnerable to cross-site scripting in the Web UI, allowing embedding of arbitrary JavaScript code that could alter functionality and potentially disclose credentials within a trusted session. This CVE entry is supported by multipl...

CVE-2021-20538

Affected product: IBM Cloud Pak for Security (CP4S) infers CP4S 1.5.0.0 and 1.5.0.1. Vulnerability: incorrect authorization could allow a user to obtain sensitive information or perform actions they should not have access to. Root cause (as stated): improper authorization mechanisms. Impact: pote...

Security Bulletin: IBM Cloud Pak for Security is vulnerable to CVE-2021-20538 and CVE-2021-20577

Summary IBM Cloud Pak for Security versions 1.5.0.1 and earlier is vulnerable to the following CVEs: CVE-2021-20538, meaning that sensitive information can be obtained by the user without sufficient authorisation. CVE-2021-20577, allowing cross side scripting that can potentially lead to...

CVE-2020-4967

IBM Cloud Pak for Security CP4S 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425...

Cross site scripting

IBM Cloud Pak for Security CP4S 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2020-4967

The CVE-2020-4967 entry concerns IBM Cloud Pak for Security (CP4S) 1.3.0.1, where the product could disclose sensitive information through HTTP response headers, potentially aiding attackers in further exploitation. Affected component is CP4S, with the root cause described as information disclosu...

CVE-2020-4820

IBM Cloud Pak for Security (CP4S) 1.4.0.0 is affected by CVE-2020-4820: a cross-site scripting vulnerability in the Web UI that can allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected product/version: Cloud Pak for Security (CP4S) 1.4.0.0. ...

CVE-2020-4816

CVE-2020-4816 affects IBM Cloud Pak for Security (CP4S) 1.4.0.0, where failure to properly enable HTTP Strict Transport Security can allow a remote attacker to disclose sensitive information via man-in-the-middle techniques. The issue is documented by IBM and related CVSS vectors indicate user im...

CVE-2020-4815

CVE-2020-4815 affects IBM Cloud Pak for Security (CP4S) 1.4.0.0 and allows a remote attacker to obtain sensitive information from HTTP response headers, enabling potential follow-on attacks. The IBM security bulletin notes the vulnerability as an information disclosure issue with a CVSS v3 base s...

CVE-2020-4815

IBM Cloud Pak for Security CP4S 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system...

CVE-2020-4628

IBM Cloud Pak for Security (CP4S) versions 1.3.0.1 and 1.4.0.0 are affected by an information disclosure vulnerability where detailed browser error messages leak sensitive information. The root cause is exposure of internal details via error messages, which could enable further attacks. Remediati...

CVE-2020-4815

IBM Cloud Pak for Security CP4S 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system...

CVE-2020-4625

IBM Cloud Pak for Security 1.3.0.1CP4S could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie...

CVE-2020-4696

CVE-2020-4696 affects IBM Cloud Pak for Security (CP4S) version 1.3.0.1. The root cause is that the session is not invalidated after logout, which could allow an authenticated user to obtain sensitive information from the previous session. Affected software: CP4S 1.3.0.1. Impact described in sour...

CVE-2020-4626

CVE-2020-4626 affects IBM Cloud Pak for Security (CP4S) 1.3.0.1. An authenticated user can cause information disclosure by sending a specially crafted HTTP request, potentially revealing sensitive internal network information. The IBM security bulletin notes the issue and provides a remediation p...