Ibm Cloud Pak For Security vulnerabilities
55 known vulnerabilities affecting ibm/cloud_pak_for_security.
Total CVEs
55
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH10MEDIUM40LOW2
Vulnerabilities
Page 2 of 3
CVE-2024-22335MEDIUMCVSS 5.5≥ 1.10.0.0, ≤ 1.10.11.02024-02-17
CVE-2024-22335 [MEDIUM] CWE-532 CVE-2024-22335: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11
IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279975.
cvelistv5nvd
CVE-2023-50951MEDIUMCVSS 4.3≥ 1.10.0.0, ≤ 1.10.11.02024-02-17
CVE-2023-50951 [MEDIUM] CWE-532 CVE-2023-50951: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11
IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747.
cvelistv5nvd
CVE-2024-22336MEDIUMCVSS 5.5≥ 1.10.0.0, ≤ 1.10.11.02024-02-17
CVE-2024-22336 [MEDIUM] CWE-532 CVE-2024-22336: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11
IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279976.
cvelistv5nvd
CVE-2022-36777MEDIUMCVSS 6.5≥ 1.10.0.0, ≤ 1.10.11.02023-11-22
CVE-2022-36777 [MEDIUM] CWE-200 CVE-2022-36777: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665.
cvelistv5nvd
CVE-2023-30993HIGHCVSS 7.5≥ 1.9.0.0, ≤ 1.9.2.02023-06-27
CVE-2023-30993 [MEDIUM] CWE-200 CVE-2023-30993: IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API k
IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136.
cvelistv5nvd
CVE-2021-39011MEDIUMCVSS 4.9≥ 1.10.0.0, ≤ 1.10.6.0≥ 1.10.0.0, < 1.10.6.02023-01-20
CVE-2021-39011 [MEDIUM] CWE-532 CVE-2021-39011:
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive informatio
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.
cvelistv5nvd
CVE-2021-39089MEDIUMCVSS 6.5≥ 1.10.0.0, ≤ 1.10.6.0≥ 1.10.0.0, < 1.10.6.02023-01-20
CVE-2021-39089 [MEDIUM] CWE-200 CVE-2021-39089: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obt
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 216387.
cvelistv5nvd
CVE-2022-38385HIGHCVSS 8.1≥ 1.10.0.0, ≤ 1.10.2.0≥ 1.10.0.0, < 1.10.2.02022-11-15
CVE-2022-38385 [HIGH] CWE-20 CVE-2022-38385:
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to ob
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 233777.
cvelistv5nvd
CVE-2022-38387HIGHCVSS 8.8≥ 1.10.0.0, ≤ 1.10.2.0≥ 1.10.0.0, < 1.10.2.02022-11-11
CVE-2022-38387 [HIGH] CWE-78 CVE-2022-38387: IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attac
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 233786.
cvelistv5nvd
CVE-2022-36776MEDIUMCVSS 5.4≥ 1.10.0.0, ≤ 1.10.2.0v1.10.0.0, 1.10.2.02022-11-11
CVE-2022-36776 [MEDIUM] CWE-79 CVE-2022-36776: IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. Thi
IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.
cvelistv5nvd
CVE-2021-39013MEDIUMCVSS 6.5v1.7.0.0v1.7.1.0+1 more2021-12-22
CVE-2021-39013 [MEDIUM] CWE-200 CVE-2021-39013: IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to
IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP responses that could be used in further attacks against the system. IBM X-Force ID: 213651.
cvelistv5nvd
CVE-2021-38911MEDIUMCVSS 4.9v1.7.2.02021-10-19
CVE-2021-38911 [MEDIUM] CWE-312 CVE-2021-38911: IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be r
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940.
cvelistv5nvd
CVE-2021-29912MEDIUMCVSS 5.4v1.7.0.02021-10-19
CVE-2021-29912 [MEDIUM] CWE-79 CVE-2021-29912: IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability
IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 207828.
cvelistv5nvd
CVE-2021-20578CRITICALCVSS 9.8v1.7.0.0v1.7.1.0+2 more2021-09-30
CVE-2021-20578 [CRITICAL] CWE-287 CVE-2021-20578: IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.
cvelistv5nvd
CVE-2021-29894HIGHCVSS 7.5v1.7.0.0v1.7.1.0+2 more2021-09-30
CVE-2021-29894 [HIGH] CWE-327 CVE-2021-29894: IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected c
IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 207320.
cvelistv5nvd
CVE-2021-29696HIGHCVSS 7.2v1.5.0.0v1.5.0.1+5 more2021-08-02
CVE-2021-29696 [HIGH] CVE-2021-29696: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could all
IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
cvelistv5nvd
CVE-2021-20541MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02
CVE-2021-20541 [MEDIUM] CVE-2021-20541: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis
IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198927.
cvelistv5nvd
CVE-2021-20540MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02
CVE-2021-20540 [MEDIUM] CVE-2021-20540: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis
IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923.
cvelistv5nvd
CVE-2021-20539MEDIUMCVSS 5.3v1.5.0.0v1.5.1.0+6 more2021-08-02
CVE-2021-20539 [MEDIUM] CVE-2021-20539: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could dis
IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.
cvelistv5nvd
CVE-2021-29697MEDIUMCVSS 4.9v1.5.0.0v1.5.0.1+5 more2021-08-02
CVE-2021-29697 [MEDIUM] CVE-2021-29697: IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could all
IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system.
cvelistv5nvd