CVE-2021-20368

CVE-2021-20368 affects IBM Cloud Pak for Applications 4.3, where a cross-site scripting vulnerability allows embedding arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin and related references confirm impact on all...

CVE-2021-20424

IBM Cloud Pak for Applications v4.3 is affected by CVE-2021-20424, where a remote attacker could obtain sensitive information when a detailed technical error message is returned in the browser. The issue stems from error messages that disclose implementation details. IBM notes remediation by upda...

CVE-2021-20369

CVE-2021-20369 concerns IBM Cloud Pak for Applications 4.3 which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The related IBM security bulletin notes the vulnerability in v4.3 and provides a fix in v4.3.1 to remove the in...

CVE-2021-20366

CVE-2021-20366 affects IBM Cloud Pak for Applications 4.x, where a cross-site scripting flaw allows embedding arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. Root cause framed as input data validation exposure (IBM notes this as an input ...

CVE-2021-20423

CVE-2021-20423 affects IBM Cloud Pak for Applications v4.3 (IBM Cloud Pak for Applications). Affected component/behavior: improper assignment/modification/tracking/checking of privileges for an actor, enabling an authenticated user to obtain escalated privileges. CVSS3.0/3.1 scores are high (8.8)...

CVE-2021-20422

CVE-2021-20422 affects IBM Cloud Pak for Applications 4.3, where a memory-based information disclosure could allow a malicious attacker to access sensitive user data stored in memory. The CVSS base score is 7.5 (HIGH). The issue is addressed in IBM Cloud Pak for Applications v4.3.1, which provide...