CVE-2021-20368

CVE-2021-20368 affects IBM Cloud Pak for Applications 4.3, where a cross-site scripting vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin and related references confirm impact on all...

CVE-2021-20360

CVE-2021-20360 affects IBM Cloud Pak for Applications v4.3. The vulnerability arises from using weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. IBM’s bulletin for this issue notes that the problem is mitigated by upgrading to I...

CVE-2021-20361

Summary (CVE-2021-20361): IBM Cloud Pak for Applications 4.3 is vulnerable to cross-site scripting via a dynamically constructed href attribute in the Web UI, potentially allowing credential disclosure within a trusted session. The IBM security bulletin notes remediation in Cloud Pak for Applicat...

CVE-2021-20424

IBM Cloud Pak for Applications v4.3 is affected by CVE-2021-20424, where a remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. The issue stems from error messages that disclose implementation details. IBM notes remediation by upda...

CVE-2021-20364

CVE-2021-20364 affects IBM Cloud Pak for Applications 4.3 with a cross-site scripting vulnerability in the Web UI that can allow an attacker to inject arbitrary JavaScript and potentially disclose credentials within a trusted session. The IBM bulletin notes a fix is included in the product; no se...

CVE-2021-20369

CVE-2021-20369 concerns IBM Cloud Pak for Applications 4.3 which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The related IBM security bulletin notes the vulnerability in v4.3 and provides a fix in v4.3.1 to remove the in...

CVE-2021-20362

CVE-2021-20362 affects IBM Cloud Pak for Applications 4.3. The vulnerability is a cross-site scripting flaw in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. IBM’s advisory notes a fix in v4.3.1; no separate APAR ...

CVE-2021-20365

Affected product: IBM Cloud Pak for Applications 4.3. The entry describes a Cross‑Site Scripting (XSS) vulnerability in the web UI that allows embedding arbitrary JavaScript, potentially exposing credentials in a trusted session. The root cause is XSS in the Web UI, with CVSS v3.0/3.1 base scores...

CVE-2021-20366

CVE-2021-20366 affects IBM Cloud Pak for Applications 4.x, where a cross-site scripting flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Root cause framed as input data validation exposure (IBM notes this as an input ...

CVE-2021-20423

CVE-2021-20423 affects IBM Cloud Pak for Applications v4.3 (IBM Cloud Pak for Applications). Affected component/behavior: improper assignment/modification/tracking/checking of privileges for an actor, enabling an authenticated user to obtain escalated privileges. CVSS3.0/3.1 scores are high (8.8)...

CVE-2021-20422

CVE-2021-20422 affects IBM Cloud Pak for Applications 4.3, where a memory-based information disclosure could allow a malicious attacker to access sensitive user data stored in memory. The CVSS base score is 7.5 (HIGH). The issue is addressed in IBM Cloud Pak for Applications v4.3.1, which provide...

CVE-2021-20363

IBM Cloud Pak for Applications 4.3 is affected by a cross-site scripting vulnerability in the Web UI that allows embedding arbitrary JavaScript, potentially exposing credentials within a trusted session. The official IBM advisory fixes this by updating to version 4.3.1, which prevents arbitrary J...