Information disclosure

IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309...

Cross site scripting

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195032...

Cross site scripting

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195035...

CVE-2021-20424

IBM Cloud Pak for Applications 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. X-Force ID: 196309...

CVE-2021-20424

IBM Cloud Pak for Applications v4.3 is affected by CVE-2021-20424, where a remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. The issue stems from error messages that disclose implementation details. IBM notes remediation by upda...

CVE-2021-20423

IBM Cloud Pak for Applications 4.3 could allow an authenticated user gain escalated privilesges due to improper application permissions. IBM X-Force ID: 196308...

CVE-2021-20423

CVE-2021-20423 affects IBM Cloud Pak for Applications v4.3 (IBM Cloud Pak for Applications). Affected component/behavior: improper assignment/modification/tracking/checking of privileges for an actor, enabling an authenticated user to obtain escalated privileges. CVSS3.0/3.1 scores are high (8.8)...

CVE-2021-20422

IBM Cloud Pak for Applications 4.3 could disclose sensitive information to a malicious attacker by accessing data stored in memory. IBM X-Force ID: 196304...

CVE-2021-20422

CVE-2021-20422 affects IBM Cloud Pak for Applications 4.3, where a memory-based information disclosure could allow a malicious attacker to access sensitive user data stored in memory. The CVSS base score is 7.5 (HIGH). The issue is addressed in IBM Cloud Pak for Applications v4.3.1, which provide...

CVE-2021-20369

CVE-2021-20369 concerns IBM Cloud Pak for Applications 4.3 which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The related IBM security bulletin notes the vulnerability in v4.3 and provides a fix in v4.3.1 to remove the in...

CVE-2021-20369

IBM Cloud Pak for Applications 4.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 195361...

CVE-2021-20368

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195357...

CVE-2021-20368

CVE-2021-20368 affects IBM Cloud Pak for Applications 4.3, where a cross-site scripting vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin and related references confirm impact on all...

CVE-2021-20366

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195037...

CVE-2021-20366

CVE-2021-20366 affects IBM Cloud Pak for Applications 4.x, where a cross-site scripting flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Root cause framed as input data validation exposure (IBM notes this as an input ...

CVE-2021-20365

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195036...

CVE-2021-20365

Affected product: IBM Cloud Pak for Applications 4.3. The entry describes a Cross‑Site Scripting (XSS) vulnerability in the web UI that allows embedding arbitrary JavaScript, potentially exposing credentials in a trusted session. The root cause is XSS in the Web UI, with CVSS v3.0/3.1 base scores...

CVE-2021-20364

IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 195035...

CVE-2021-20364

CVE-2021-20364 affects IBM Cloud Pak for Applications 4.3 with a cross-site scripting vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM bulletin notes a fix is included in the product; no se...

CVE-2021-20363

IBM Cloud Pak for Applications 4.3 is affected by a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially exposing credentials within a trusted session. The official IBM advisory fixes this by updating to version 4.3.1, which prevents arbitrary J...