IBM Cloud Pak For Security

Unauthorized config leak in IBM QRadar & Cloud Pak (v1.10.12.0-1.11.2.0)
CVE-2025-25022 9.6 - Critical - June 03, 2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.

Password in Configuration File

IBM QRadar 1.10.12.0-1.11.2.0 Privileged Code Exec in CM Script
CVE-2025-25021 7.2 - High - June 03, 2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a privileged execute code in case management script creation due to the improper generation of code.

Code Injection

IBM QRadar 1.10.12-1.11.2 Local File Storage Leak
CVE-2025-1334 4 - Medium - June 03, 2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can be read by another user on the system.

Use of Web Browser Cache Containing Sensitive Information

IBM QRadar Suite: Session Not Invalidated After Logout (CVE-2025-25019)
CVE-2025-25019 6.5 - Medium - June 03, 2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not invalidate session after a logout which could allow a user to impersonate another user on the system.

Insufficient Session Expiration

IBM QRadar API DoS via Impr. Inp. Val. 1.10.12–1.11.2 & 1.10.0–1.10.11
CVE-2025-25020 6.5 - Medium - June 03, 2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an authenticated user to cause a denial of service due to improperly validating API data input.

Improper Validation of Specified Type of Input

IBM QRadar & Cloud Pak Sec: Error Msg Disclosure v1.10.1222
CVE-2023-47728 6.5 - Medium - August 16, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information could be used in further attacks against the system. IBM X-Force ID: 272201.

Generation of Error Message Containing Sensitive Information

IBM QRadar Suite 1.10.12.0-1.10.23.0 User Credentials Stored Plain Text
CVE-2024-25024 5.5 - Medium - August 15, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430.

Cleartext Storage of Sensitive Information

QRadar 1.10.12-1.10.23 & Cloud Pak 1.10.0-1.10.11: Privileged Disclosure
CVE-2024-28799 7.5 - High - August 14, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 displays sensitive data improperly to a local privileged user, in non default configurations, during back-end commands which may result in the unexpected disclosure of this information. IBM X-Force ID: 287173.

Invocation of Process Using Visible Sensitive Information

IBM CP4S/QRadar: Session not invalidated after logout (Pre1.10.23)
CVE-2022-38382 4.1 - Medium - August 13, 2024

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672.

Insufficient Session Expiration

MSSL Sensitive Log Exposure in IBM Cloud Pak for Security/QRadar (1.10.0.0-1.10.22.0)
CVE-2024-25023 5.5 - Medium - July 10, 2024

IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429.

Cleartext Storage of Sensitive Information

IBM CP4S 1.10.x / QRadar 1.10.x Local File Read via Stored Web Pages
CVE-2022-38383 3.3 - Low - June 28, 2024

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Software Suite 1.10.12.0 through 1.10.21.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 233673.

IBM QRadar Suite Software 1.10.12-1.10.21 Auth Cmd Exec via Inp Val
CVE-2023-47726 8.8 - High - June 18, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.21.0 and IBM Cloud Pak for Security 1.10.12.0 through 1.10.21.0 could allow an authenticated user to execute certain arbitrary commands due to improper input validation. IBM X-Force ID: 272087.

Improper Validation of Specified Type of Input

IBM Cloud Pak/Security <1.10.12 & QRadar <1.10.21: Auth Dash Param Mod
CVE-2023-47727 - May 02, 2024

IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation. IBM X-Force ID: 272089.

Improper Validation of Specified Type of Input

Missing SameSite Cookie in IBM CP4S & QRadar 1.10.x Enables MITM
CVE-2022-38386 5.9 - Medium - May 01, 2024

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778.

Sensitive Cookie with Improper SameSite Attribute

IBM QRadar Suite 1.10.12.0-1.10.19.0 Stored XSS in Web UI
CVE-2023-47731 - April 23, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.19.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 272203.

XSS

IBM QRadar Suite 1.10.12-1.10.18 Plaintext Credential Storage Vulnerability
CVE-2024-28782 6.5 - Medium - April 03, 2024

IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 285698.

Unprotected Storage of Credentials

IBM QRadar 1.10.12.01.10.18.0: Cert Validation Bypass Allows MITM Info Disclosure
CVE-2023-47742 - March 03, 2024

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 272533.

Improper Certificate Validation

IBM QRadar & Cloud Pak: Weak Password Policy (1.10.12-1.10.18)
CVE-2024-22355 5.9 - Medium - March 03, 2024

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 280781.

IBM CP4S 1.10.x Missing HSTS Enablement Exposes Sensitive Data
CVE-2021-39090 5.9 - Medium - February 29, 2024

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 216388.

Cleartext Transmission of Sensitive Information

IBM QRadar/Cloud Pak 1.10.x Log Sensitive Info Exposure
CVE-2024-22337 5.5 - Medium - February 17, 2024

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279977.

Insertion of Sensitive Information into Log File

IBM QRadar Suite Info Exposure via Log Files [1.10.12.0-1.10.17.0]
CVE-2024-22336 5.5 - Medium - February 17, 2024

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279976.

Insertion of Sensitive Information into Log File

IBM QRadar Suite & Cloud Pak for Security Log File Local Info Exposure
CVE-2024-22335 5.5 - Medium - February 17, 2024

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279975.

Insertion of Sensitive Information into Log File

IBM QRadar Suite & Cloud Pak: Log Sensitive Info Exposure 1.10.12-1.10.17
CVE-2023-50951 4.3 - Medium - February 17, 2024

IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747.

Insertion of Sensitive Information into Log File

IBM CP4S & QRadar: Auth User Can Retrieve Version Info (v1.10.0.0v1.10.16.0)
CVE-2022-36777 6.5 - Medium - November 22, 2023

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 233665.

IBM CP4S 1.9.0.01.9.2.0: API Key Tenant Isolation Flaw
CVE-2023-30993 7.5 - High - June 27, 2023

IBM Cloud Pak for Security (CP4S) 1.9.0.0 through 1.9.2.0 could allow an attacker with a valid API key for one tenant to access data from another tenant's account. IBM X-Force ID: 254136.

Information Disclosure

IBM CP4S 1.10.x Authenticated HTTP Info Disclosure
CVE-2021-39089 6.5 - Medium - January 20, 2023

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request. IBM X-Force ID: 216387.

Information Disclosure

IBM CP4S 1.10.x Log Disclosure Vulnerability (CVE-2021-39011)
CVE-2021-39011 4.9 - Medium - January 20, 2023

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.

Insertion of Sensitive Information into Log File

IBM CP4S 1.10.0.0-1.10.2.0 Authenticated Info Disclosure via Improper Input Validation
CVE-2022-38385 8.1 - High - November 15, 2022

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized actions due to improper input validation. IBM X-Force ID: 233777.

Improper Input Validation

Remote command execution in IBM CP4S 1.10.0.0-1.10.2.0
CVE-2022-38387 8.8 - High - November 11, 2022

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 233786.

Shell injection

IBM CP4S 1.10.0.0/1.10.2.0 XSS in Web UI
CVE-2022-36776 5.4 - Medium - November 11, 2022

IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663.

XSS

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could
CVE-2021-20578 - September 30, 2021

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to improper or missing authentication controls. IBM X-Force ID: 199282.

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests
CVE-2021-29697 4.9 - Medium - August 02, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obtain sensitive information through HTTP requests that could be used in further attacks against the system.

IBM Cloud Pak for Security (CP4S) 1.5.0.0
CVE-2021-20539 - August 02, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198920.

IBM Cloud Pak for Security (CP4S) 1.5.0.0
CVE-2021-20540 - August 02, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198923.

IBM Cloud Pak for Security (CP4S) 1.5.0.0
CVE-2021-20541 - August 02, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthorized user through HTTP GET requests. This information could be used in further attacks against the system. IBM X-Force ID: 198927.

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could
CVE-2021-29696 7.2 - High - August 02, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could
CVE-2020-4811 2.4 - Low - May 14, 2021

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation.

Improper Input Validation

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could
CVE-2021-20564 - May 14, 2021

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 199235.

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism
CVE-2021-20565 - May 14, 2021

IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. IBM X-Force ID: 199236.

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could
CVE-2021-20538 - May 10, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting
CVE-2021-20577 - May 10, 2021

IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199281.

IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers
CVE-2020-4967 4.3 - Medium - January 27, 2021

IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks against the system. IBM X-Force ID: 192425.

Information Disclosure

IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could
CVE-2020-4628 5.3 - Medium - January 27, 2021

IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 185369.

Generation of Error Message Containing Sensitive Information

IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could
CVE-2020-4696 4.3 - Medium - November 30, 2020

IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitive information from the previous session. IBM X-Force ID: 186789.

Insufficient Session Expiration

IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection
CVE-2020-4627 9 - Critical - November 30, 2020

IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367.

Injection

IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request
CVE-2020-4626 4.3 - Medium - November 30, 2020

IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a specially crafted HTTP request. IBM X-Force ID: 185362.

Information Disclosure

IBM Cloud Pak for Security 1.3.0.1(CP4S) could
CVE-2020-4625 5.3 - Medium - November 30, 2020

IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

Information Disclosure

IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could
CVE-2020-4624 5.3 - Medium - November 30, 2020

IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to decrypt sensitive information.

Use of a Broken or Risky Cryptographic Algorithm