Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers [CVE-2025-14924, CVE-2025-14928, CVE-2025-14929, CVE-2025-14930]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Hugging Face Transformers CVE-2025-14924, CVE-2025-14928, CVE-2025-14929, CVE-2025-14930. Hugging Face Transformers is used in our speech runtimes. This vulnerabilitiy has been addressed. Please read the details for...

CVE-2025-14930

A flaw was found in the Hugging Face Transformers library. The parsing of weights fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious GLM4 model, resulting in arbitrary code execution in the context of the...

allennlp (>=1.0.0rc4.dev20200513, <=1.0.0rc6.dev20200601), allennlp-models (>=1.0.0rc4, <=1.0.0rc5) potentially affected by CVE-2025-14930 via transformers (2.9.1)

transformers PYPI version 2.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.0.0rc4.dev20200513, =1.0.0rc4, =1.0.0rc5 Source cves: CVE-2025-14930 Source advisory: OSV:PYSEC-2025-218...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2025-14930 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

boolean-question (0.0.3), ernie (0.0.19b0) +6 more potentially affected by CVE-2025-14930 via transformers (2.5.1)

transformers PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - boolean-question 0.0.3 - ernie 0.0.19b0 - methylbert =0.0.2, =0.0.1, =0.0.1a0, =0.1.1, =0.1.19, =0.2.0, =0.2.12 Source cves:...

allennlp (>=1.2.0rc1.dev20201022, <=1.2.1), allennlp-models (>=1.2.0rc1.dev20201022, <=1.2.1) +5 more potentially affected by CVE-2025-14930 via transformers (3.4.0)

transformers PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.2.0rc1.dev20201022, =1.2.0rc1.dev20201022, =0.0.4, =0.0.1, =2.2.5, =2.3.1 Source cves: CVE-2025-14930 Source advisory:...

adamix-gpt2 (>=0.0.1, <=0.0.2), allennlp (>=1.2.0rc1.dev20200930, <=1.2.0rc1.dev20201021) +6 more potentially affected by CVE-2025-14930 via transformers (3.3.1)

transformers PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - adamix-gpt2 =0.0.1, =1.2.0rc1.dev20200930, =1.2.0rc1.dev20201007, =0.0.1, =0.5.0, =0.1.11, =0.1.12 - mc-transformers 0.1.11 Source cves:...

allennlp (>=1.1.0rc1.dev20200710, <=1.1.0), allennlp-models (>=1.1.0rc1, <=1.1.0) +26 more potentially affected by CVE-2025-14930 via transformers (3.0.2)

transformers PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =1.1.0rc1.dev20200710, =1.1.0rc1, =0.7.1, =0.0.1, =0.1.0, =0.4.6, =1.9.0, =0.0.1.dev0, =0.3.1, =0.1.0, =0.1.3 and more Source...

3m (0.1.0), aaa-ml-datasets-course (1.0.0) +1946 more potentially affected by CVE-2025-14930 via transformers (>=4.0.0rc1, <=4.57.1)

transformers PYPI version =4.0.0rc1, =0.0.4.80, =0.1.1, =0.1.0, =0.0.3, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.3.3 and more Source cves: CVE-2025-14930 Source advisory: OSV:PYSEC-2025-218...

CVE-2025-14930

creationtimestamp| type| source ---|---|--- 2025-12-18 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-1145/ 2025-12-23 21:34:48+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115771027410495980...

CVE-2020-14930

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but i...

Linux Distros Unpatched Vulnerability : CVE-2017-14930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory leak in decodelineinfo in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to...

CVE-2019-14930

creationtimestamp| type| source ---|---|--- 2024-01-29 10:41:44+00:00| seen| https://t.me/ctinow/175152...

SUSE CVE-2017-14930

Memory leak in decodelineinfo in dwarf2.c in the Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service memory consumption via a crafted ELF file...

Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU Use of Hard-Coded Credentials (CVE-2019-14930)

An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. Also, the accounts ineaadmin and mitsadm...

Sql injection

doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability

ZOHO ManageEngine Applications Manager is an IT operations management solution from ZOHO, Inc. Zoho ManageEngine Applications Manager through 14930 is vulnerable to SQL injection, which can be exploited to perform an authenticated SQL injection into showresource.do via the resourceid parameter...

CVE-2020-14930

The CVE-2020-14930 issue affects BT CTROMS Terminal OS Port Portal CT-464. The password-reset flow discloses the verification token in response to a getverificationcode.jsp request, sending the token not only to the user’s registered phone but also to an unauthenticated HTTP client. This could en...

Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2020-1205)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-14930

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. Also, the accounts ineaadmin...