Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

41 records

Vendor: IBM Component: Cloud Pak System Clear all filters
TI-2023-30889 CVE-2023-38375 · GHSA-qcpj-652c-hcfv

Cross-site scripting in IBM Cloud Pak System Web UI

Priority LOW 27

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00194 Published 2026-10-19 No fix listed CWE-79
TI-2026-76514 CVE-2026-3161 · GHSA-2pff-h2q8-4jc4

Risky cryptographic algorithm in IBM Cloud Pak System

Priority LOW 32

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00171 Published 2026-10-19 No fix listed CWE-327
TI-2026-76515 CVE-2026-3295 · GHSA-g698-cvpw-9x59

Stored cross-site scripting in IBM Cloud Pak System

Priority LOW 32

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00177 Published 2026-10-19 No fix listed CWE-79
TI-2026-76520 CVE-2026-4418 · GHSA-vj5c-2vfj-v63r

HTML injection in IBM Cloud Pak System

Priority LOW 24

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00177 Published 2026-10-19 No fix listed CWE-80
TI-2023-19436 CVE-2023-38005 · GHSA-qvc7-4wrw-mpgp

Improper access control in IBM Cloud Pak System

Priority LOW 20

IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access controls.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00235 Published 2026-02-17 No fix listed CWE-284
TI-2023-19684 CVE-2023-38281 · GHSA-6jv7-gp56-rq3m

Multiple Vulnerabilities in IBM Cloud Pak System

Priority LOW 30

IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00317 Published 2026-02-04 No fix listed CWE-209
TI-2023-19439 CVE-2023-38010 · GHSA-23xf-jw4c-q879

Multiple Vulnerabilities in IBM Cloud Pak System

Priority LOW 39

IBM Cloud Pak System displays sensitive information in user messages that could aid in further attacks against the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00324 Published 2026-02-04 No fix listed CWE-209
TI-2025-02530 CVE-2025-2895 · GHSA-5p4x-fj73-85h8

IBM Cloud Pak System HTML injection

Priority LOW 24

IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00259 Published 2025-06-30 No fix listed CWE-80
TI-2023-19437 CVE-2023-38007 · GHSA-gc29-jc84-4r2v

IBM Cloud Pak System HTML injection

Priority LOW 24

IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0026 Published 2025-06-27 No fix listed CWE-80
TI-2023-19679 CVE-2023-38272 · GHSA-w7fp-pj56-6xc6

IBM Cloud Pak System information disclosure

Priority LOW 33

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the network to obtain sensitive…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00353 Published 2025-03-27 No fix listed CWE-300
TI-2023-19023 CVE-2023-37405 · GHSA-56r2-5qqm-ppfv

IBM Cloud Pak System information disclosure

Priority LOW 28

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an una…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00238 Published 2025-03-27 No fix listed CWE-311
TI-2023-19678 CVE-2023-38271 · GHSA-jfx2-4jj8-x2wj

IBM Cloud Pak System information disclosure

Priority LOW 29

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00321 Published 2025-01-25 No fix listed CWE-532
TI-2023-20059 CVE-2023-38713 · GHSA-vqrh-582c-2w2r

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further at…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-209
TI-2023-20060 CVE-2023-38714 · GHSA-qjp6-cp7g-v8xv

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further at…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-209
TI-2023-19441 CVE-2023-38013 · GHSA-m2fr-34qc-xrjj

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further a…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0033 Published 2025-01-25 No fix listed CWE-201
TI-2023-19440 CVE-2023-38012 · GHSA-j7vf-q996-69xm

IBM Cloud Pak System directory traversal

Priority LOW 31

IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00514 Published 2025-01-25 No fix listed CWE-22
TI-2023-20061 CVE-2023-38716 · GHSA-c52r-r6j6-x3c5

IBM Cloud Pak System information disclosure

Priority LOW 39

IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2025-01-25 No fix listed CWE-209
TI-2023-19680 CVE-2023-38273 · GHSA-283h-3w9j-26xq

IBM Cloud Pak System information disclosure

Priority MEDIUM 40

IBM Cloud Pak System 2.3.1.1, 2.3.2.0, and 2.3.3.7 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00674 Published 2024-02-02 No fix listed CWE-307
TI-2020-04142 CVE-2020-4914 · GHSA-5vcx-9483-28vf

IBM Cloud Pak System Software Suite session fixation

Priority LOW 24

IBM Cloud Pak System Suite 2.3.3.0 through 2.3.3.5 does not invalidate session after logout which could allow a local user to impersonate another user on the system.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00148 Published 2023-05-05 No fix listed CWE-613
TI-2021-03730 CVE-2021-20479 · GHSA-xr5m-vqc6-vc94

Broken or risky cryptographic algorithm in IBM Cloud Pak System

Priority LOW 34

IBM Cloud Pak System 2.3.0 through 2.3.3.3 Interim Fix 1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2022-05-09 No fix listed CWE-327
TI-2020-04152 CVE-2020-4928 · GHSA-j684-c6q4-x85p

Unrestricted file upload in IBM Cloud Pak System

Priority LOW 30

IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00368 Published 2021-01-04 No fix listed CWE-434
Load more