IBM Cloud Pak For Security vulnerabilities

53 CVEs affecting IBM Cloud Pak For Security, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-25022, published 2025-06-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-29696, published 2021-08-02. High severity, CVSS 7.2. EPSS: 2.5% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a…
CVE-2020-4627, published 2020-11-30. Critical severity, CVSS 9.0. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents.…
CVE-2020-4625, published 2020-11-30. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this…
CVE-2021-29697, published 2021-08-02. Medium severity, CVSS 4.9. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could…
CVE-2020-4815, published 2021-01-27. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be used in further attacks against the system.
CVE-2020-4628, published 2021-01-27. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This…
CVE-2020-4816, published 2021-01-27. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could…
CVE-2021-20578, published 2021-09-30. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID:…
CVE-2020-4626, published 2020-11-30. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362.
CVE-2022-38387, published 2022-11-11. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM…

Latest

CVE-2025-25022, published 2025-06-03. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive…
CVE-2025-25021, published 2025-06-03. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case management script creation due to the…
CVE-2025-25020, published 2025-06-03. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly…
CVE-2025-25019, published 2025-06-03. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate…
CVE-2025-1334, published 2025-06-03. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can be read by another user on the system.
CVE-2023-47728, published 2024-08-16. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical…
CVE-2024-25024, published 2024-08-15. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM…
CVE-2024-28799, published 2024-08-14. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in non default…
CVE-2022-38382, published 2024-08-13. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated…
CVE-2024-25023, published 2024-07-10. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local…