CP
Product
Cloud Pak System
41
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 13Medium 24Low 3
Watch
Add Cloud Pak System to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-4521 | 9.8 | Dec 10 | Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection Affected: 2.3; 2.3.0.1 |
| CVE-2020-4917 | 8.8 | Jan 4 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the… Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2019-4130 | 8.8 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server Affected: 2.3; 2.3.0.1 |
| CVE-2026-13463 | 7.5 | Jul 28 | Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability [] Affected: 2.3.5.0 |
| CVE-2023-38010 | 7.5 | Feb 4 | IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system Affected: 2.3.4.0; 2.3.4.1; 2.3.4.1; 2.3.5.0; 2.3.6.0 |
| CVE-2023-38272 | 7.5 | Mar 27 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user… Affected: 2.3.1.1; 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; +7 more |
| CVE-2023-38716 | 7.5 | Jan 25 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further… Affected: 2.3.3.6; 2.3.3.6; 2.3.3.6; 2.3.3.7; 2.3.3.7; 2.3.4.0 |
| CVE-2023-38714 | 7.5 | Jan 25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information… Affected: 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; 2.3.3.6; +4 more |
| CVE-2023-38713 | 7.5 | Jan 25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information… Affected: 2.3.0.0; 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; +5 more |
| CVE-2023-38013 | 7.5 | Jan 25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in… Affected: 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; 2.3.3.6; +4 more |
| CVE-2023-38273 | 7.5 | Feb 2 | IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials Affected: 2.3.3.0 through 2.3.3.6; 2.3.1.1; 2.3.2.0; 2.3.3.7 |
| CVE-2021-20479 | 7.5 | May 9 | IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.3.0.0 before 2.3.3.4 |
| CVE-2026-3295 | 7.4 | Oct 19 | IBM Cloud Pak System Cross-Site Scripting Affected: 2.3.6.0; 2.3.6.1 |
| CVE-2020-4912 | 7.2 | Jan 4 | IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2020-4928 | 6.7 | Jan 4 | IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2023-37405 | 6.5 | Mar 27 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in… Affected: 2.3.1.1; 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; +7 more |
| CVE-2023-38271 | 6.5 | Jan 25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to… Affected: 2.3.3.0; 2.3.3.3; 2.3.3.3; 2.3.3.4; 2.3.3.5; 2.3.3.6; +4 more |
| CVE-2023-38375 | 6.1 | Oct 19 | IBM Cloud Pak System Cross-Site Scripting Affected: 2.3.6.0; 2.3.6.1 |
| CVE-2026-3161 | 5.9 | Oct 19 | IBM Cloud Pak System Risky Cryptographic Algorithm Affected: 2.3.6.0; 2.3.6.1 |
| CVE-2026-4418 | 5.4 | Oct 19 | IBM Cloud Pak System HTML Injection Affected: 2.3.6.0; 2.3.6.1 |
| CVE-2025-2895 | 5.4 | Jun 30 | IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection Affected: 2.3.3.6; 2.3.3.6; 2.3.3.7; 2.3.3.7; 2.3.4.0; 2.3.4.1; +1 more |
| CVE-2023-38007 | 5.4 | Jun 27 | IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML… Affected: 2.3.3.6; 2.3.3.6; 2.3.3.6; 2.3.3.7; 2.3.3.7; 2.3.4.0; +2 more |
| CVE-2019-4468 | 5.4 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting Affected: 2.3; 2.3.0.1 |
| CVE-2019-4467 | 5.4 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting Affected: 2.3; 2.3.0.1 |
| CVE-2019-4226 | 5.4 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting Affected: 2.3; 2.3.0.1 |
| CVE-2019-4098 | 5.4 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 is vulnerable to cross-site scripting Affected: 2.3; 2.3.0.1 |
| CVE-2023-38265 | 5.3 | Feb 17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose folder location information to an unauthenticated attacker that could aid in further attacks… Affected: 2.3.3.6; 2.3.3.7; 2.3.4.0; 2.3.4.1; 2.3.5.0 |
| CVE-2023-38281 | 5.3 | Feb 4 | IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies Affected: 2.3.4.0; 2.3.4.1; 2.3.4.1; 2.3.5.0; 2.3.6.0 |
| CVE-2023-38017 | 5.3 | Feb 4 | IBM Cloud Pak System is vulnerable to cross-site scripting Affected: 2.3.4.0; 2.3.4.1; 2.3.4.1; 2.3.5.0; 2.3.6.0 |
| CVE-2023-38012 | 5.3 | Jan 25 | IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system Affected: 2.3.3.6; 2.3.3.6; 2.3.3.6; 2.3.3.7; 2.3.3.7; 2.3.4.0 |
| CVE-2020-4916 | 4.8 | Jan 4 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2020-4910 | 4.8 | Jan 4 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2020-4909 | 4.8 | Jan 4 | IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2020-4918 | 4.4 | Jan 4 | IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform… Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2020-4913 | 4.4 | Jan 4 | IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2023-38005 | 4.3 | Feb 17 | IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access controls Affected: 2.3.3.6; 2.3.3.7; 2.3.4.0; 2.3.4.1; 2.3.5.0 |
| CVE-2019-4095 | 4.3 | Dec 10 | IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the… Affected: 2.3; 2.3.0.1 |
| CVE-2020-4914 | 4.2 | May 5 | IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system Affected: 2.3.3.0 before 2.3.3.6 |
| CVE-2020-4919 | 3.8 | Jan 4 | IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system Affected: 2.3.0.0 before 2.3.3.3 |
| CVE-2021-20478 | 3.3 | Jul 20 | IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console Affected: 2.3 |
| CVE-2019-4465 | 3.3 | Dec 3 | IBM Cloud Pak System 2.3 and 2.3.0.1 allows web pages to be stored locally which can be read by another user on the system Affected: 2.3; 2.3.0.1 |
Showing 41