Ibm Cloud Pak System vulnerabilities
41 known vulnerabilities affecting ibm/cloud_pak_system.
Total CVEs
41
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH13MEDIUM24LOW3
Vulnerabilities
Page 1 of 3
CVE-2019-4130P3HIGHCVSS 8.8v2.3v2.3.0.1+1 more2019-12-03
CVE-2019-4130 [HIGH] CWE-434 CVE-2019-4130: IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which
IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280.
nvd
CVE-2019-4521P3CRITICALCVSS 9.8v2.3v2.3.0.12019-12-10
CVE-2019-4521 [CRITICAL] CWE-1236 CVE-2019-4521: Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A re
Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.
nvd
CVE-2026-13463P3HIGHCVSS 7.5v2.3.5.02026-07-28
CVE-2026-13463 [HIGH] CWE-798 CVE-2026-13463: IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.
nvd
CVE-2023-38273P3HIGHCVSS 7.5≥ 2.3.3.0, ≤ 2.3.3.6v2.3.1.1+3 more2024-02-02
CVE-2023-38273 [HIGH] CWE-307 CVE-2023-38273: IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that c
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733.
nvd
CVE-2026-3295P3HIGHCVSS 7.4v2.3.6.0v2.3.6.12026-10-19
CVE-2026-3295 [HIGH] CWE-79 CVE-2026-3295: IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑su
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and la
nvd
CVE-2023-38272P3HIGHCVSS 7.5v2.3.1.1v2.3.3.0+11 more2025-03-27
CVE-2023-38272 [HIGH] CWE-300 CVE-2023-38272: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1
could allow a user with access to the network to obtain sensitive information from CLI arguments.
nvd
CVE-2023-38010P3HIGHCVSS 7.5v2.3.4.0v2.3.4.1+3 more2026-02-04
CVE-2023-38010 [HIGH] CWE-209 CVE-2023-38010: IBM Cloud Pak System displays sensitive information in user messages that could aid in further attac
IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.
nvd
CVE-2021-20479P3HIGHCVSS 7.5≥ 2.3.0.0, < 2.3.3.4v2.3.0+1 more2022-05-09
CVE-2021-20479 [HIGH] CWE-327 CVE-2021-20479: IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic alg
IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197498.
nvd
CVE-2023-38716P3HIGHCVSS 7.5v2.3.3.6v2.3.3.7+2 more2025-01-25
CVE-2023-38716 [HIGH] CWE-209 CVE-2023-38716: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38713P3HIGHCVSS 7.5v2.3.0.0v2.3.3.0+6 more2025-01-25
CVE-2023-38713 [HIGH] CWE-209 CVE-2023-38713: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38714P3HIGHCVSS 7.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38714 [HIGH] CWE-209 CVE-2023-38714: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38013P3HIGHCVSS 7.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38013 [HIGH] CWE-201 CVE-2023-38013: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.
nvd
CVE-2020-4917P3HIGHCVSS 8.8≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4917 [HIGH] CWE-352 CVE-2020-4917: IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker t
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391.
nvd
CVE-2020-4912P3HIGHCVSS 7.2≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4912 [HIGH] CVE-2020-4912: IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the us
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
nvd
CVE-2023-37405P4MEDIUMCVSS 6.5v2.3.1.1v2.3.3.0+10 more2025-03-27
CVE-2023-37405 [MEDIUM] CWE-311 CVE-2023-37405: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user.
nvd
CVE-2023-38012P4MEDIUMCVSS 5.3v2.3.3.6v2.3.3.7+2 more2025-01-25
CVE-2023-38012 [MEDIUM] CWE-22 CVE-2023-38012: IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 coul
IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
nvd
CVE-2023-38271P4MEDIUMCVSS 6.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38271 [MEDIUM] CWE-532 CVE-2023-38271: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.
nvd
CVE-2026-3161P4MEDIUMCVSS 5.9v2.3.6.0v2.3.6.12026-10-19
CVE-2026-3161 [MEDIUM] CWE-327 CVE-2026-3161: IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that co
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
nvd
CVE-2020-4928P4MEDIUMCVSS 6.7≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4928 [MEDIUM] CWE-434 CVE-2020-4928: IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By inter
IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705.
nvd
CVE-2026-4418P4MEDIUMCVSS 5.4v2.3.6.0v2.3.6.12026-10-19
CVE-2026-4418 [MEDIUM] CWE-80 CVE-2026-4418: IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
nvd
1 / 3Next →