Ibm Cloud Pak System vulnerabilities
36 known vulnerabilities affecting ibm/cloud_pak_system.
Total CVEs
36
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH11MEDIUM21LOW3
Vulnerabilities
Page 1 of 2
CVE-2019-4130P3HIGHCVSS 8.8v2.3v2.3.0.1+1 more2019-12-03
CVE-2019-4130 [HIGH] CWE-434 CVE-2019-4130: IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which
IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 158280.
nvd
CVE-2019-4521P3CRITICALCVSS 9.8v2.3v2.3.0.12019-12-10
CVE-2019-4521 [CRITICAL] CWE-1236 CVE-2019-4521: Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A re
Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 165179.
nvd
CVE-2023-38273P3HIGHCVSS 7.5≥ 2.3.3.0, ≤ 2.3.3.6v2.3.1.1+3 more2024-02-02
CVE-2023-38273 [HIGH] CWE-307 CVE-2023-38273: IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that c
IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 260733.
nvd
CVE-2023-38272P3HIGHCVSS 7.5v2.3.1.1v2.3.3.0+11 more2025-03-27
CVE-2023-38272 [HIGH] CWE-300 CVE-2023-38272: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1
could allow a user with access to the network to obtain sensitive information from CLI arguments.
nvd
CVE-2023-38010P3HIGHCVSS 7.5v2.3.4.0v2.3.4.1+3 more2026-02-04
CVE-2023-38010 [HIGH] CWE-209 CVE-2023-38010: IBM Cloud Pak System displays sensitive information in user messages that could aid in further attac
IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.
nvd
CVE-2021-20479P3HIGHCVSS 7.5≥ 2.3.0.0, < 2.3.3.4v2.3.0+1 more2022-05-09
CVE-2021-20479 [HIGH] CWE-327 CVE-2021-20479: IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic alg
IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197498.
nvd
CVE-2023-38716P3HIGHCVSS 7.5v2.3.3.6v2.3.3.7+2 more2025-01-25
CVE-2023-38716 [HIGH] CWE-209 CVE-2023-38716: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38713P3HIGHCVSS 7.5v2.3.0.0v2.3.3.0+6 more2025-01-25
CVE-2023-38713 [HIGH] CWE-209 CVE-2023-38713: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38714P3HIGHCVSS 7.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38714 [HIGH] CWE-209 CVE-2023-38714: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
nvd
CVE-2023-38013P3HIGHCVSS 7.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38013 [HIGH] CWE-201 CVE-2023-38013: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.
nvd
CVE-2020-4917P3HIGHCVSS 8.8≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4917 [HIGH] CWE-352 CVE-2020-4917: IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker t
IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391.
nvd
CVE-2020-4912P3HIGHCVSS 7.2≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4912 [HIGH] CVE-2020-4912: IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the us
IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287.
nvd
CVE-2023-37405P4MEDIUMCVSS 6.5v2.3.1.1v2.3.3.0+10 more2025-03-27
CVE-2023-37405 [MEDIUM] CWE-311 CVE-2023-37405: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user.
nvd
CVE-2023-38012P4MEDIUMCVSS 5.3v2.3.3.6v2.3.3.7+2 more2025-01-25
CVE-2023-38012 [MEDIUM] CWE-22 CVE-2023-38012: IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 coul
IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
nvd
CVE-2023-38271P4MEDIUMCVSS 6.5v2.3.3.0v2.3.3.3+5 more2025-01-25
CVE-2023-38271 [MEDIUM] CWE-532 CVE-2023-38271: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.
nvd
CVE-2020-4928P4MEDIUMCVSS 6.7≥ 2.3.0.0, < 2.3.3.3v2.32021-01-04
CVE-2020-4928 [MEDIUM] CWE-434 CVE-2020-4928: IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By inter
IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705.
nvd
CVE-2023-38265P4MEDIUMCVSS 5.3v2.3.3.6v2.3.3.7+4 more2026-02-17
CVE-2023-38265 [MEDIUM] CWE-548 CVE-2023-38265: IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location
IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid in further attacks against the system.
nvd
CVE-2023-38281P4MEDIUMCVSS 5.3v2.3.4.0v2.3.4.1+3 more2026-02-04
CVE-2023-38281 [MEDIUM] CWE-209 CVE-2023-38281: IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. A
IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traff
nvd
CVE-2023-38017P4MEDIUMCVSS 5.3v2.3.4.0v2.3.4.1+3 more2026-02-04
CVE-2023-38017 [MEDIUM] CWE-209 CVE-2023-38017: IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed
IBM Cloud Pak System is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
nvd
CVE-2023-38007P4MEDIUMCVSS 5.4v2.3.3.6v2.3.3.7+6 more2025-06-27
CVE-2023-38007 [MEDIUM] CWE-80 CVE-2023-38007: IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iF
IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
nvd
1 / 2Next →