Ibm Cloud Pak For Security vulnerabilities

55 known vulnerabilities affecting ibm/cloud_pak_for_security.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL3HIGH10MEDIUM40LOW2

Vulnerabilities

SortPage 2 of 3

CVE-2024-22355P4MEDIUMCVSS 5.9≥ 1.10.0.0, ≤ 1.10.11.02024-03-03

CVE-2024-22355 [MEDIUM] CWE-521 CVE-2024-22355: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 throug IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 280781.

nvd

CVE-2023-47742P4MEDIUMCVSS 5.9≥ 1.10.0.0, ≤ 1.10.11.02024-03-03

CVE-2023-47742 [MEDIUM] CWE-295 CVE-2023-47742: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 throug IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 272533.

nvd

CVE-2021-39090P4MEDIUMCVSS 5.9≥ 1.10.0.0, < 1.10.7.0≥ 1.10.0.0, ≤ 1.10.6.02024-02-29

CVE-2021-39090 [MEDIUM] CWE-311 CVE-2021-39090: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 216388.

nvd

CVE-2020-4816P4MEDIUMCVSS 5.9v1.4.0.02021-01-27

CVE-2020-4816 [MEDIUM] CWE-862 CVE-2020-4816: IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive informat IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 189703.

nvd

CVE-2021-20564P4MEDIUMCVSS 5.9v1.4.0.0v1.5.0.0+3 more2021-05-14

CVE-2021-20564 [MEDIUM] CWE-319 CVE-2021-20564: IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remo IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 1992

nvd

CVE-2023-47731P4MEDIUMCVSS 5.4≥ 1.10.0.0, ≤ 1.10.11.02024-04-23

CVE-2023-47731 [MEDIUM] CWE-79 CVE-2023-47731: IBM QRadar Suite Software 1.10.12.0 through 1.10.19.0 and IBM Cloud Pak for Security 1.10.0.0 throug IBM QRadar Suite Software 1.10.12.0 through 1.10.19.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

nvd

CVE-2020-4820P4MEDIUMCVSS 6.1v1.4.0.02021-01-27

CVE-2020-4820 [MEDIUM] CWE-79 CVE-2020-4820: IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

nvd

CVE-2020-4625P4MEDIUMCVSS 5.3v1.3.0.12020-11-30

CVE-2020-4625 [MEDIUM] CWE-732 CVE-2020-4625: IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive informati IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

nvd

CVE-2021-20539P4MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02

CVE-2021-20539 [MEDIUM] CVE-2021-20539: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.

nvd

CVE-2021-20540P4MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02

CVE-2021-20540 [MEDIUM] CVE-2021-20540: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923.

nvd

CVE-2021-20541P4MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02

CVE-2021-20541 [MEDIUM] CVE-2021-20541: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198927.

nvd

CVE-2021-20565P4MEDIUMCVSS 5.3v1.4.0.0v1.5.0.0+3 more2021-05-14

CVE-2021-20565 [MEDIUM] CVE-2021-20565: IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. IBM X-Force ID: 199236.

nvd

CVE-2020-4624P4MEDIUMCVSS 5.3v1.3.0.12020-11-30

CVE-2020-4624 [MEDIUM] CWE-327 CVE-2020-4624: IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.

nvd

CVE-2021-20577P4MEDIUMCVSS 6.1v1.5.0.0v1.5.0.12021-05-10

CVE-2021-20577 [MEDIUM] CWE-79 CVE-2021-20577: IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vu IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281.

nvd

CVE-2020-4815P4MEDIUMCVSS 5.3v1.4.0.02021-01-27

CVE-2020-4815 [MEDIUM] CWE-200 CVE-2020-4815: IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.

nvd

CVE-2021-29912P4MEDIUMCVSS 5.4v1.7.0.02021-10-19

CVE-2021-29912 [MEDIUM] CWE-79 CVE-2021-29912: IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.

nvd

CVE-2024-25023P4MEDIUMCVSS 5.5≥ 1.10.0.0, ≤ 1.10.11.02024-07-10

CVE-2024-25023 [MEDIUM] CWE-312 CVE-2024-25023: IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 throug IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.

nvd

CVE-2021-38911P4MEDIUMCVSS 4.9v1.7.2.02021-10-19

CVE-2021-38911 [MEDIUM] CWE-312 CVE-2021-38911: IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be r IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940.

nvd

CVE-2020-4628P4MEDIUMCVSS 5.3v1.3.0.1v1.4.0.02021-01-27

CVE-2020-4628 [MEDIUM] CWE-209 CVE-2020-4628: IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensit IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.

nvd

CVE-2024-22336P4MEDIUMCVSS 5.5≥ 1.10.0.0, ≤ 1.10.11.02024-02-17

CVE-2024-22336 [MEDIUM] CWE-532 CVE-2024-22336: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11 IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279976.

nvd

← Previous2 / 3Next →