CVE-2021-20361

Summary (CVE-2021-20361): IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting via a dynamically constructed href attribute in the Web UI, potentially allowing credential disclosure within a trusted session. The IBM security bulletin notes remediation in Cloud Pak for Applicat...

CVE-2021-20368

CVE-2021-20368 affects IBM Cloud Pak for Applications 4.3, where a cross-site scripting vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin and related references confirm impact on all...

CVE-2021-20424

IBM Cloud Pak for Applications v4.3 is affected by CVE-2021-20424, where a remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. The issue stems from error messages that disclose implementation details. IBM notes remediation by upda...

CVE-2021-20360

CVE-2021-20360 affects IBM Cloud Pak for Applications v4.3. The vulnerability arises from using weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. IBM’s bulletin for this issue notes that the problem is mitigated by upgrading to I...

CVE-2021-20369

CVE-2021-20369 concerns IBM Cloud Pak for Applications 4.3 which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The related IBM security bulletin notes the vulnerability in v4.3 and provides a fix in v4.3.1 to remove the in...

CVE-2021-20362

CVE-2021-20362 affects IBM Cloud Pak for Applications 4.3. The vulnerability is a cross-site scripting flaw in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. IBM’s advisory notes a fix in v4.3.1; no separate APAR ...

CVE-2021-20364

CVE-2021-20364 affects IBM Cloud Pak for Applications 4.3 with a cross-site scripting vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM bulletin notes a fix is included in the product; no se...

CVE-2021-20365

Affected product: IBM Cloud Pak for Applications 4.3. The entry describes a Cross‑Site Scripting (XSS) vulnerability in the web UI that allows embedding arbitrary JavaScript, potentially exposing credentials in a trusted session. The root cause is XSS in the Web UI, with CVSS v3.0/3.1 base scores...

CVE-2021-20423

CVE-2021-20423 affects IBM Cloud Pak for Applications v4.3 (IBM Cloud Pak for Applications). Affected component/behavior: improper assignment/modification/tracking/checking of privileges for an actor, enabling an authenticated user to obtain escalated privileges. CVSS3.0/3.1 scores are high (8.8)...

CVE-2021-20366

CVE-2021-20366 affects IBM Cloud Pak for Applications 4.x, where a cross-site scripting flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Root cause framed as input data validation exposure (IBM notes this as an input ...

CVE-2021-20363

IBM Cloud Pak for Applications 4.3 is affected by a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially exposing credentials within a trusted session. The official IBM advisory fixes this by updating to version 4.3.1, which prevents arbitrary J...

CVE-2021-20422

CVE-2021-20422 affects IBM Cloud Pak for Applications 4.3, where a memory-based information disclosure could allow a malicious attacker to access sensitive user data stored in memory. The CVSS base score is 7.5 (HIGH). The issue is addressed in IBM Cloud Pak for Applications v4.3.1, which provide...