IBM Cloud Pak for Security
55 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-25020 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software and IBM Cloud Pak for Security improper input validation | MEDIUM 6.5 | 0.4 % | ||
| CVE-2025-1334 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure | MEDIUM 4.0 | 0.2 % | ||
| CVE-2025-25021 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software and IBM Cloud Pak for Security code injection | HIGH 7.2 | 0.7 % | ||
| CVE-2025-25022 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure | CRITICAL 9.6 | 0.3 % | ||
| CVE-2025-25019 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software and IBM Cloud Pak for Security session fixation | MEDIUM 6.5 | 0.3 % | ||
| CVE-2023-47728 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software information disclosure | HIGH 7.5 | 0.5 % | ||
| CVE-2024-25024 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software information disclosure | MEDIUM 5.5 | 0.1 % | ||
| CVE-2024-28799 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software information disclosure | HIGH 7.5 | 0.3 % | ||
| CVE-2022-38382 | 1.10.0.0 – 1.10.11.0 | IBM Cloud Pak for Security session fixation | MEDIUM 4.7 | 0.3 % | ||
| CVE-2024-25023 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software information disclosure | MEDIUM 5.5 | 0.1 % | ||
| CVE-2022-38383 | 1.10.0.0 – 1.10.11.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 4.0 | 0.2 % | ||
| CVE-2023-47726 | 1.10.12.0 – 1.10.21.0 | IBM QRadar Suite improper input validation | HIGH 8.8 | 0.4 % | ||
| CVE-2023-47727 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software file manipulation | MEDIUM 4.3 | 0.3 % | ||
| CVE-2022-38386 | 1.10.0.0 – 1.10.11.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 5.9 | 0.5 % | ||
| CVE-2023-47731 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software cross-site scripting | MEDIUM 5.4 | 0.3 % | ||
| CVE-2024-28782 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite Software information disclosure | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-22355 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information dislosure | MEDIUM 5.9 | 0.4 % | ||
| CVE-2023-47742 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information dislosure | MEDIUM 5.9 | 0.2 % | ||
| CVE-2021-39090 | 1.10.0.0 – 1.10.6.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 5.9 | 0.4 % | ||
| CVE-2023-50951 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information disclosure | MEDIUM 4.3 | 0.4 % | ||
| CVE-2024-22337 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information disclosure | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-22336 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information disclosure | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-22335 | 1.10.0.0 – 1.10.11.0 | IBM QRadar Suite information disclosure | MEDIUM 5.5 | 0.2 % | ||
| CVE-2022-36777 | 1.10.0.0 – 1.10.11.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-30993 | 1.9.0.0 – 1.9.2.0 | IBM Cloud Pak for Security information disclosure | HIGH 7.5 | 0.6 % | ||
| CVE-2021-39089 | 1.10.0.0 – < 1.10.6.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 6.5 | 0.7 % | ||
| CVE-2021-39011 | 1.10.0.0 – < 1.10.6.0 | IBM Cloud Pak for Security information disclosure | MEDIUM 4.9 | 0.6 % | ||
| CVE-2022-36776 | 1.10.0.0, 1.10.2.0 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar | MEDIUM 5.4 | 0.4 % | ||
| CVE-2022-38385 | 1.10.0.0 – < 1.10.2.0 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perf | HIGH 8.1 | 0.6 % | ||
| CVE-2022-38387 | 1.10.0.0 – < 1.10.2.0 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the | HIGH 8.8 | 1.0 % | ||
| CVE-2021-39013 | 1.7.0.0 ; 1.7.1.0 ; 1.7.2.0 | IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP re | MEDIUM 6.5 | 0.8 % | ||
| CVE-2021-38911 | 1.7.2.0 | IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged us | MEDIUM 4.9 | 0.5 % | ||
| CVE-2021-29912 | 1.7.0.0 | IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri | MEDIUM 5.4 | 0.5 % | ||
| CVE-2021-29894 | 1.7.0.0 ; 1.7.1.0 ; 1.7.2.0 ; … | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow | HIGH 7.5 | 0.7 % | ||
| CVE-2021-20578 | 1.7.0.0 ; 1.7.1.0 ; 1.7.2.0 ; … | IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to impr | CRITICAL 9.8 | 1.0 % | ||
| CVE-2021-29697 | 1.6.0.0 ; 1.5.0.1 ; 1.5.0.0 ; … | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to ob | MEDIUM 4.9 | 1.4 % | ||
| CVE-2021-29696 | 1.6.0.0 ; 1.5.0.1 ; 1.5.0.0 ; … | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to ex | HIGH 8.0 | 2.5 % | ||
| CVE-2021-20541 | 1.6.0.0 ; 1.5.0.1 ; 1.5.0.0 ; … | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-20540 | 1.6.0.0 ; 1.5.0.1 ; 1.5.0.0 ; … | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-20539 | 1.6.0.0 ; 1.5.0.1 ; 1.5.0.0 ; … | IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-20565 | 1.4.0.0 ; 1.6.0.0 ; 1.5.0.1 ; … | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence o | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-20564 | 1.4.0.0 ; 1.6.0.0 ; 1.5.0.1 ; … | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive informat | MEDIUM 5.9 | 0.9 % | ||
| CVE-2020-4811 | 1.4.0.0 ; 1.6.0.0 ; 1.5.0.1 ; … | IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious d | LOW 2.4 | 0.7 % | ||
| CVE-2021-20577 | 1.5.0.1 ; 1.5.0.0 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr | MEDIUM 6.1 | 0.6 % | ||
| CVE-2021-20538 | 1.5.0.1 ; 1.5.0.0 | IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not | CRITICAL 9.1 | 0.7 % | ||
| CVE-2020-4967 | 1.3.0.1 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks a | MEDIUM 4.3 | 0.8 % | ||
| CVE-2020-4820 | 1.4.0.0 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri | MEDIUM 6.1 | 0.7 % | ||
| CVE-2020-4816 | 1.4.0.0 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly e | MEDIUM 5.9 | 1.2 % | ||
| CVE-2020-4815 | 1.4.0.0 | IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be | MEDIUM 5.3 | 1.3 % | ||
| CVE-2020-4628 | 1.3.0.1 ; 1.4.0.0 | IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technica | MEDIUM 5.3 | 1.3 % | ||
| CVE-2020-4696 | 1.3.0.1 | IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitiv | MEDIUM 5.3 | 0.8 % | ||
| CVE-2020-4627 | 1.3.0.1 | IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the | CRITICAL 9.0 | 1.6 % | ||
| CVE-2020-4626 | 1.3.0.1 | IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a spe | MEDIUM 5.0 | 1.0 % | ||
| CVE-2020-4625 | 1.3.0.1 | IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTT | MEDIUM 5.3 | 1.5 % | ||
| CVE-2020-4624 | 1.3.0.1 | IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to d | MEDIUM 5.3 | 0.7 % |